Specifically, we're using
fwm logexport piped to
logger to dump the audit logs in real time via syslog to our SEIM. It works great if the command is run manually (in the background) from the "expert" command line, but then we have to remember to go back in and re-start it after a reboot.
The "Job Scheduler" allows for running a job at startup time, but it doesn't allow you to enter multiple commands connected with a pipe, and it turns out that its "@startup" happens too early in the boot process for this use (before all the CP processes have started).
Gaia tends to overwrite settings that are made outside of the configuration tools, but I don't know how extensive that is, so I'm hoping there's an official place for custom scripts that won't get purged.