You could potentially alert on not receiving any logs from a host over a certain interval.