Yes please, 2 questions : 

1) Is there a way to run aureport on updating auditd logs ? That is, not 
running aureport on all logs, just updating the last aureport with the 
recent addition of logs ? 
2) Could aureport run on combined auditd logs from more than one computor 
and produce multiple outputs ? 

Thank you 


To answer the above
For 1. use the -checkpoint option of ausearch to generate the events.
For 2. assuming you disseminate the source hosts on  the aggregating host, again
multiple invocations of ausearch will work with the -checkpoint option.

Rgds