Hi Diego,
There could be a possibility that at some point when the files were not pushed in the auditing database, due the fact that some services have been stopped suddenly without that they had enough time to write the audit information back to the CMS database.
"Note: If you wish to remove a server from your BOE deployment, you should first disable that server but keep it running and connected to your network until all the events in the temporary files have had a chance to post to the auditing database (the location of the temporary files is determined by the Auditing Temporary Directory setting on the CMC settings for that server). This may take several hours."
This is the reason why some files staying orphan at the Auditing Temporary Directory. Thus, once you stop a server and there still existing some information inside the Auditing Temporary Directory for that server, that information will be lost and there is no way to write it back to the audit database.
You can refer the same information in Admin guide.
Regards,
Medha