Well, it depends.
If you're sending accounting messages for commands from your router, it would either be in the report with Radius Accounting or TACACS+ Accounting.
If you're performing command authorization it would be in the report for TACACS+ Authorization.
If you provide a 'show run | inc aaa' it should be enough detail to determine what report you need to look at.
