Have auditd log to a remote syslog host

remotesyslog.conf

# /etc/auditsp/plugins.d/remotesyslog.conf
#
# This file controls the audispd data path to the
# remote event logger. This plugin will send events to
# a remote machine (Central Logger).

active = yes
direction = out
path = /etc/audisp/remotesyslog.sh
type = always
args = <YOURSYSLOGHOST>
format = string

remotesyslog.sh

#!/bin/bash

# Logger keep quitting on EOF from socket so we need
# a sub process around that
(
  while true
  do
    read LINE || exit
    if [ -n "${LINE}" ]
    then 
      /usr/bin/logger --priority auth.info --server ${1} --tag audisp "${LINE}"
    fi
    sleep 0.01
  done
)

Setup syslog host with remote reception enabled using classic "syslogd -r" or rsyslog.
Disable writing local logfiles with write_logs = no in /etc/audit/auditd.conf