i found the problem - sqlserver audits are not supported for Linux
however these are the selects
SELECT GETDATE();
SELECT
event_time AS Login_Time,
server_instance_name ,
statement AS Description
FROM sys.fn_get_audit_file('/backup/audit/*.sqlaudit', DEFAULT, DEFAULT)
WHERE
action_id = 'LGIF'
go
SELECT GETDATE();
SELECT
event_time AS Login_Time,
server_instance_name ,
statement AS Description
FROM sys.fn_get_audit_file('/backup/audit/*.sqlaudit', DEFAULT, DEFAULT)
WHERE
action_id = 'LGIS'
go