Puppet

See http://www.puppetlabs.com/blog/all-about-auditing-with-puppet/

Seems like this should almost be a separate configuration from the manifests. It might be worthwhile to say “audit everything”, or “audit all files owners and modes”, or “audit all packages” rather than having to add audit information to manifests all around the system.

Auditing definitely seems like more of an aspect (in the “aspect-oriented” sense of the word), which would benefit from specification external to the detailed manifest information.