Major Description
The reason is that HDFS file stream's flush() call does not really flush the data all the way to disk, nor even makes the data visible to HDFS users. See the HDFS semantics of the flush/sync at https://issues.apache.org/jira/browse/HADOOP-6313.
Consequently the audit logs on HDFS won't be visible/durable from HDFS client until the log file is closed. This will, among other issues, boost chances of losing audit logs in case of system failure.