Hi. Thanks for sharing. I wanted to point out one clarification. The data in the SystemData.AUDIT table does not come from system or application logs. That data comes from audit records that are stored in the SAS Infrastructure Data Server (PostgreSQL database). When a user performs some action against a service, that service might create an audit record for the action. The audit record might be recorded in the database by the audit microservice. A job runs every two hours to extract the audit records from the database and load them into SystemData.AUDIT.
As for the example where audit data about reports being read not showing up, that is because, by default, the audit microservice does not record report "read" actions. The reason for this is due to the volume of audit records that can be generated.
More information about the auditing can be found here: SAS Help Center: Auditing: Overview
... View more