Audit files that are complete have names of the following form:
start-time.finish-time.machine |
where start-time is the time of the first audit record in the audit file, finish-time is the time of the last record, and machine is the name of the machine that generated the file. An example of these names can be found in "Example of a Closed Audit File Name".
If the audit log file is still active, it has a name of the following form:
start-time.not_terminated.machine |