Audit data is either written to files, or output as SNMP events. You use the mfauditadm command to access the audit output data.
Before you can access data from the active file, you must make it available for dumping.