The Audit Log Adapter is designed to re-read the raw audit log file if the adapter is shut down and restarted. The adapter maintains the last timestamp processed from its previous execution. When re-reading the raw audit log file, the adapter will process all entries with the timestamp equal to or greater than the last timestamp from the previous execution. In some cases, this may mean that the same entry is processed twice in the final audit log file.
If the raw audit log file rolls over while the Audit Log Adapter is shut down, the adapter will only process entries in the current raw audit log file. Any entries in the previous audit log file (named <server_name>_audit.log.bak) are not processed. In this case, you must ensure that the previous raw audit log file is saved to retain information on the changes made during the time when the adapter was shut down.
