Add logic so originating IP address of the syslog message does not need to match the IP of the device in the node list. All the IP addresses for a device are stored in the IPAddresses table. Query the originating IP address of the syslog message to verify it belongs to a node. If so then proceed with downloading the config and doing the comparison.
This will be a huge time saver and prevent detection being missed due to a change in the IP address in the node list, Not having to add the logging source-interface in hundreds of devices, and not missing detection due to an IP re-address on interfaces of the node which could make the logging source-interface IP change.
Regards.