/DESTINATION=filespec

    When changing the destination of event messages, specifies
    the new location of the system security audit log file. The
    device, if part of the file specification, must be a disk. The
    /DESTINATION qualifier requires the /JOURNAL qualifier in this
    case.

    Once you have relocated the log file, execute the command SET
    AUDIT/SERVER=NEW_LOG to let all the nodes in the cluster know of
    the new location. The previous audit log file is closed and all
    subsequent audit event messages generated throughout the cluster
    are sent to the new audit log file.

    When used with /ARCHIVE, specifies the name of the archive log
    file. Events can be archived to a local or remote file on any
    file-structured disk device. For example, you can use an archive
    file to redirect event messages from a satellite to a larger node
    in the cluster.