Each administration application for each server instance writes login attempt information to its own authentication audit log file. If your environment consists of multiple production servers, you can collect and concatenate these separate files if your organization requires a single, comprehensive file.