It would be nice to see some improvements on device tracking information.
- Full list of Hostnames(IPs) sending events and show the last event received time
- Systems could be aged out after a customizable defined period of time of no events received
- Notifications if a system has not sent an event in the past day/week/month
- % of volume in the past day/week/month
Implementing some of these items would make it easier for admins to find problem systems in regards to log forwarding.