After looking at this more, I think this would be of serious concern to anyone looking to use the audit feature in production. There is no way to know if a script ran on a host because the log seems to just say "servers". Basically it throws out the audit log for script auditing because there is no way to know if a script was run on a host. I suppose you could extrapolate from the database the time a host was added or moved to the group and compare it to when the bulk audit was run but I don't think that is reasonable approach.
See screenshot. They are missing. This was discussed previously with no decision. https://github.com/amidaware/tacticalrmm/issues/995
After looking at this more, I think this would be of serious concern to anyone looking to use the audit feature in production. There is no way to know if a script ran on a host because the log seems to just say "servers". Basically it throws out the audit log for script auditing because there is no way to know if a script was run on a host. I suppose you could extrapolate from the database the time a host was added or moved to the group and compare it to when the bulk audit was run but I don't think that is reasonable approach.