<div class="content"><p align="right"><a href="https://msdn.microsoft.com/en-us/library/3fff1c62-e8b1-4bc8-b18a-3ba6458ec622" data-linktype="external">msdn link</a></p><p>The POLICY_AUDIT_LOG_INFO structure contains information
about the state of the audit log. The following structure corresponds to the
PolicyAuditLogInformation information class.</p><dl>
<dd>
<div><pre> typedef struct _POLICY_AUDIT_LOG_INFO {
   unsigned long AuditLogPercentFull;
   unsigned long MaximumLogSize;
   LARGE_INTEGER AuditRetentionPeriod;
   unsigned char AuditLogFullShutdownInProgress;
   LARGE_INTEGER TimeToShutdown;
   unsigned long NextAuditRecordId;
 } POLICY_AUDIT_LOG_INFO,
  *PPOLICY_AUDIT_LOG_INFO;
</pre></div>
</dd></dl><p><b>AuditLogPercentFull:</b>  A measure of
how full the audit log is, as a percentage.</p><p><b>MaximumLogSize:</b>  The maximum size of
the auditing log, in kilobytes (KB).</p><p><b>AuditRetentionPeriod:</b>  The auditing
log retention period (64-bit signed integer), a 64-bit value that represents
the number of 100-nanosecond intervals since January 1, 1601, <a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_f2369991-a884-4843-a8fa-1505b6d5ece7" data-linktype="relative-path">UTC</a>. An audit record can be
discarded if its time stamp predates the current time minus the retention
period.</p><p><b>AuditLogFullShutdownInProgress:</b>  A
Boolean flag; indicates whether or not a system shutdown is being initiated due
to the security audit log becoming full. This condition occurs only if the
system is configured to shut down when the log becomes full. </p><dl>
<dd>
<p>After a shutdown has been initiated, this flag MUST
be set to TRUE (nonzero). If an administrator can correct the situation before
the shutdown becomes irreversible, this flag MUST be reset to FALSE (0). </p>
</dd>
<dd>
<p>This field MUST be ignored for set operations.</p>
</dd></dl><p><b>TimeToShutdown:</b>  A 64-bit value that
represents the number of 100-nanosecond intervals since January 1, 1601, UTC.
If the AuditLogFullShutdownInProgress flag is set, this field MUST contain the
time left before the shutdown becomes irreversible.</p><p><b>NextAuditRecordId:</b>  Not in use. This
field SHOULD be set to zero when sent, and MUST be ignored on receipt.</p></div>