Logging
By default, IAS logs to local files (%systemroot%\LogFiles\IAS\*) though it can be configured to log to SQL as well (or in place of).
When logging to SQL, IAS appears to wrap the data into XML, then calls the stored procedure report_event, passing the XML data as text... the stored procedure can then unwrap the XML and save data as desired by the user.
Read more about this topic: Internet Authentication Service