The audit logs are configured to be sent to syslog. In a default SIMP install, this does not send them to an external host until one is defined.
References: AU-4 (1)