Look for the '*.aud' files under $OH/rdbms/audit.