Would the osquery syslog table help?