Every operator action is a line. File contents are never stored. Probe noise (random 401s) lives in its own ring so it cannot push real history out.
Search free text, pick a machine, pick who did it, pick a kind. “Rejections & probes” is the scanner noise. Click a machine cell to filter on it. This is the durable record; the live page is only a window. The same trail while you are already on a machine is See who opened this machine.
Keeping only the line for opening a machine is Show when someone opened a machine. One machine is Limit the audit trail to one machine. One person is Show one person's audit lines. A word in the line is Find an audit line by a word. The same trail while you are already on a machine is See who opened this machine.