I have both HDFS audit and DB audit enabled from HDFS Name Node (HA) Ranger plugin.
1. HDFS NN process queues audit events in memory for HDFS. It flushes out to HDFS only once a day.
2. HDFS NN process queues audit events in memory for DB if DB connection is down. Where is the source from which it recovers when DB connection is backup? Is it from HDFS audit logs? If yes, then audit into DB depends on audit into HDFS.
Regarding to your answer 1: where to locate the local file? In spool directory? I can't find any in DB spool directory.