Audit log messages are written in the event log on the server that performs the actual operation, but not necessarily the server that owns the object. So, audit log messages for a single object are usually scattered across the enterprise. For example, in Figure 5.1, if the Test queue on User 1's computer in the San Francisco site is deleted by the User 2 (located in the Seattle site), the audit message is written on the PEC of the Seattle site.
Figure 5.1
Because all queue operations except Read Message and Peek Message are performed by an MSMQ controller server, audits are generated on the server that carried out the operation. However, when a queue is opened for read or peek, the audits for this operation are always generated on the computer where the queue resides. The audit happens when the queue is opened (for peek or receive), not each time a message is received.
Note Each audit has an open entry and close entry in the event log. For Read Message and Peek Message audits, the close audit is written to the event log immediately after the open audit is written to the event log.