[CentOS] Selinux logging and reporting in centos 7

Seems odd the stock logwatch polls for audit data in messages while the
stock config has that data sent to /var/log/audit/audit.log? Not sure why
that doesn't have a distro specific override...

So on that premise, what are people using for reports on headless c7
instances without a gui? Anything better than logwatch worth investigating?

Thanks,
jlc