Quota violations are not reported to syslog (not at the NOTICE level or higher anyway). This makes dynamic monitoring of user quotas very difficult. More mundane messages (such as authenticated un/mount requests) do get logged however...!?
run warnquota as a cron job.