An administrator maintaining a house or company border firewall would like to know as soon as possible about certain classes of hits — forged outgoing traffic, for instance — but otherwise probably only wants a periodic report. A daemon to watch firewall logs and support reporting at configurable intervals based on the types of traffic it's seen could solve this problem.