Based on a request from a conference, I created a freebsd-audit() source, which can follow FreeBSD audit logs and create syslog messages from them. You can find the configuration snippet in my blog at https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-for-syslog-ng Please create an SCL from it.