Example of a File Name for a Still-Active File

The format of a file name of a still-active file is shown below:

YYYYMMDDHHMMSS.not_terminated.hostname

Here is an example:

19900327225243.not_terminated.lazy

The audit log files are named by the beginning date, so the example above was started in 1990, on March 27, at 10:52:43 p.m, GMT. The not_terminated in the file name means either that the file is still active or that auditd was unexpectedly interrupted. The name lazy at the end is the host name whose audit data is being collected.