If your GM is HA and the GM failed over, you'll need to check the audit logs on the passive GM appliance as well. Also, if you did a GMC promotion, you'll need to check on the "old" GM for the audit logs.
This is my solution to get around the syslog issue. Its still a work in progress, but I'm getting closer. https://community.infoblox.com/t5/Reporting/Parsing-Syslog-Before-Sending-to-Reporter/m-p/11317#M503