We have to remember that Linux Audit is not the only audit standard in the Unix & Linux world. There is a BSM standard as well which is mostly used in the *BSD systems.
Here's what I suggest (after applying Gilles' suggestions):
- audit and auditing should be used for general questions about auditing, like this one (Is there a tool for seeing audit events as they happen without writing them to the disk?).
- Let's merge auditd with linux-audit which seems to be suitable for questions about the Linux Audit standard and framework. This would be a tag for questions on Linux Audit logs, auditd, auditctl, etc. We should try to add a tag related to the OS of the original poster since the versions of audit frameworks on different GNU/Linux distros tend to differ significantly.
- Maybe in the future there will be the need to create a tag for the BSM auditing standard (bsm maybe?) but for the time being there are no questions about this very specific topic.
Apart from that there is a closely related tag log which often refers to the files produced by auditing tools.
Given the differences between Linux, Solaris, AIX, and *BSD auditing, and barring any known direction by POSIX to create a common auditing standard, my knee-jerk reaction would be to create OS-specific tags for each. Given that it seems that all of the auditd questions are Linux-based, I see no reason not to merge it into linux-audit. The site's general philosophy on tags persuades me in this direction, to better identify questions and answers of particular interest.
I don't know if it'd be valuable to simplify auditing tags down to just a single "audit" and require that the associated OS also be tagged. It seems to me that most on-topic, answerable questions on the site would be based in a particular OS (or two). I would be persuaded in this direction based mainly on the small number of auditing-related questions.