Auditing IDM events - where is the config stored?

Stupid question, but when you use iManager and enable auditing on the
IDM driver/driverset either through Audit or CEF or XDAS, where is the
config stored?

It persists between iManager sessions, ergo it is stored. BUt I was
looking at the objects in LDAP and cannot quite see where they are being
written.

On the NCP Server object eDir auditing is stored in one of three
multivalued attributes:
NAuditINstrumentation
xdasConfiguration
cefConfiguration (I think, I should look this one up).

They use different formats, but whatever.

I do not see the IDM auditing options I selected written there, nor on
the driver nor driverset objects, in any place obvious that I looked.

Anyone know?