The ausearch/aureport applications support being passed a directory. The naming scheme for all of auditd's logs is that they have a number appended to the file name to indicate an ordering. The file name must match the filename in auditd.conf's log_file config option. Typically it's audit.log. The number appended is sequential with the largest number being the oldest log. In the case that the log is the current log being written to, it shall not have a number appended. If the files conform to this, it works today.

The only problem comes when someone decides they want to reorganize the files by appending some other numbering scheme to the files. How do you accommodate all possible numbering schemes?