I'd very much like to take advantage of my existing centralized syslog setup to archive off my audit logs should the host "have issues" that require a trustworthy audit.
http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log#native_auditd_syslogging