Audit logging in microservices

[kumarmah1981]

I’m designing audit logging for a microservices platform (API Gateway + multiple Go services, gRPC/REST, running on Kubernetes) and want to understand common industry patterns. Internal services communicate through GRPC, API gateway has rest endpoints for outside world.
Specifically:
Where are audit events captured? At the API Gateway, middleware, inside each service, or both?
How are audit events transmitted? Synchronous vs. asynchronous? Middleware vs. explicit events?
How is audit data aggregated? Central audit service, shared DB, or event streaming (Kafka, etc.)?
How do you avoid audit logging becoming a performance bottleneck? Patterns like batching, queues, or backpressure?
Looking for real-world architectures or best practices on capturing domain-level changes (who did what, when, and what changed)
Your insights would be really helpful.