The audit log file is found on every Admin Node and contains a collection of individual audit messages.
Each audit message contains the following:
The Coordinated Universal Time (UTC) of the event that triggered the audit message (ATIM) in ISO 8601 format (that is, YYYY-MM-DDTHH:MM:SS.UUUUUU, where UUUUUU are microseconds), followed by a space.
The audit message itself, enclosed within square brackets and beginning with "AUDT."
The following is part of a sample log file:
2014-07-17T21:16:49.634203 [AUDT:[CNID(UI64):1405569153677780][INIE(FC32):LOCL][RSLT(FC 32):SUCS][AVER(UI32):10][ATIM(UI64):1405631809634203][ATYP(F C32):ETCC][ANID(UI32):16259461][AMID(FC32):CONL][ATID(UI64): 14665900343074544330][ASQN(UI64):263][ASES(UI64):14055691536 33087]] 2014-07-17T21:16:49.863879 [AUDT:[CNID(UI64):1405569153677782][INIE(FC32):LOCL][RSLT(FC 32):SUCS][AVER(UI32):10][ATIM(UI64):1405631809863879][ATYP(F C32):ETCC][ANID(UI32):16259461][AMID(FC32):CONL][ATID(UI64): 89577087142912923][ASQN(UI64):264][ASES(UI64):14055691536330 87]] 2014-07-17T21:16:52.606919 [AUDT:[SEID(FC32):CONS][CNDR(FC32):INBO][SVIP(UI32):1406][DA IP(IPAD):"127.0.0.1"][SAIP(IPAD):"127.0.0.1"][CNID(UI64):140 5569167131673][RSLT(FC32):SUCS][AVER(UI32):10][ATIM(UI64):14 05631812606919][ATYP(FC32):ETCA][ANID(UI32):16039415][AMID(F C32):PSVR][ATID(UI64):18353570832908893687][ASQN(UI64):258][ ASES(UI64):1405569167108360]]