we are working on sending the audit.log via Syslog. At the moment there is no simple solution for this.
Good Luck in achieving this.
have you had any luck in setting fields for the CEF format to Arcsight?
We would like to have more fields but we cannot map them correctly.