Instead of writing MapR audit events to a log file, out put the log event to a MapRStream (Kafka) that can be consumed by a listener rather than writing to a volume. (Or allow for both writing to a stream or a log file)
This will simplify the process of capturing an event and would reduce the need for storing the logs.
The other upside is that it will make it easier to filter the events and down stream processing.
If this is already a feature, please let me know where I can find it in the documentation.
(Note: I could write a named pipe to do this... but would rather have something native from MapR)