Import audits from a text file into the SSOX_Audit table

If the remote audit server is not reachable, audits are recorded in files in the “~\SSOX\sas” directory of the solution installation directory in files named “sqlAudit.aud”, “tmpaudit.aud”, or “lost_and_found.aud”.

File sqlAudit.aud

This file records all audits received by the audit server but not yet recorded in the database due to database unavailability.

After the database is restored, the data in this file is automatically imported into the database.

File tmpAudit.aud

This file records all audits not sent by the audit service if the audit server is not reachable.

After the connection to the audit server is restored, the data in this file is automatically imported into the database.

File Lost_and_found.aud

This file records all the audits received in a non-compliant format due to a configuration error, or forged audits...

The data in this file can, after being corrected and made compliant, be imported into the database by renaming the file “Lost_and_found.aud” to “sqlAudit.aud”. These audits will then be added to the database the next time an audit is generated.