Reading a years worth of Top Secret audit entries on tape with TSSUTIL and it take hours to run. The selection criteria is set to produce a small number of audit entries in the TSSUTIL report.
Release : 16.0
TSSUTIL will read EVERY record on that tape to see if matches the search criteria you specified.
If there is only one instance that exists of a security event on that tape, but there are 1 million security events on that tape, TSSUTIL will read EVERY security event to generate the report with that one security event.
So the search time would be the same if you were reporting on 1 audit event or 500,000 audit events.