We have a site with a couple of document libraries, one is very large (~16 Gb |  25000 Files | 2500 Folders). 

We have encountered a couple of problems, one of them is when you run Audit reports it returns "unknown error". It seems the bigger the site/document libraries the more likely you are to receive this. So we had to work out a way of getting Audit reports preferably without moving documents into new small document libraries.

So presumably this information is stored in the SharePoint databases? I like many others work on the premise that it is fine to read information out of these databases but DEFINATELY not to update these expect through the SharePoint interfaces.

So we went hunting and some time later.....

We found a table called AuditData (in the relevant Content DB), which contains most of the information required. We also used the UserInfo table to understand who performed the action.

AuditData contained most of the data - we were interested in the ItemType Column, UserID, DocLocation, Occurred, Event, EventData.

Some complicated data analysis later.... We established that everything we were interested in was ItemType 1 and the the Event could be used to determine what type of event. 

Therefore you can construct a query that brings back this information for individual sites, this is very basic and then needs some formatting applied.

SELECT     a.Event, u.tp_Login, a.Occurred, 'http://sharepoint/' + a.DocLocation AS [Document]
FROM         WSS_Content1.dbo.AuditData AS a INNER JOIN
                      WSS_Content1.dbo.UserInfo AS u ON a.UserId = u.tp_ID
WHERE     (a.DocLocation LIKE 'site/%') AND (a.ItemType = 1) AND (a.UserId <> '1073741823')

• WSS_Content1 = relevant content db
• http://sharepoint/ = your portal url
• site/ = the site you are interested in this portal url