Look in the Audit trail and see what commands were executed for both "show audit-trail". Each controller has a local configuration for traps and syslog, so it must be done for each individually.
If you checked those and you cannot find the issue, please open a support case.