Hello Philip,
To make you understand about how auditing works,
CMS server or service acts as an system auditor which captures the information of an event and the server or application that triggers an auditable event is known as auditee. When an audited event is triggered, the auditee will generate a record and store it in a local temporary file. At regular intervals, the CMS communicates with the auditees to request these records and write the data to a database called Auditing Data Store (ADS).
The steps are as follows:-
1. An auditable event is performed by the server.
2. The auditee writes events in a temporary file.
3. The auditor polls the auditee and requests a batch of auditing events.
4. The auditee retrieves the events from the temporary files.
5. The auditee transmits the events to the auditor.
6. The auditor writes events to the ADS and signals the auditee to delete the events from the temporary files.
I would recommend you to have a look at CMS Polling interval, if you can do something with this
Regards
Mani