Where are the auth logs in OpenShift?

I'm trying to audit access logs (including failed access attempts). I have a fluentd collector running so I can export the logs but I can't find them to export them! I thought this might help, but when I use the console and go to Workloads → Pods → fluentd or cluster logging logs I don't see auth events anywhere there.