aa-notify should have a live reporting feature for server use

Currently aa-notify can monitor the log and report to the desktop. This is not useful for monitoring servers.

I suggest a new feature or extension to aa-notify:

1) to run as a service that reports DENIED instantly.
2) a configurable mechanism for dispatching reports.
3) pass DENIED report in a computer parsable format, possibly schema based.

As an example an admin might configure the service to dispatch to:

a) the "mail" command
b) a custom service client that calls a central service collecting reports from multiple servers, aggregating results in a live webapp.