If you want to create OSSEC alerts when a log or the output of a command changes, take a look at the new check_diff option.