I know that, when you are auditing logins, the messages go to the SQL Error log and the Windows Application log. I have been asked to provide documentation that explicitly states that these are the locations where the messages go.