I am very surprised this event did not trigger an audit log entry. Reach out to support to see if they know of a method to produce the audit information in this case.
Additionally, I suggest filing a BigFix Idea (HCL way of saying Request for Enhancement [RFE]) via the BigFix Ideas Portal to add this very audit-worthy logging capability to the server. Personally, I would have expected to see (at a minimum) the following events already to be in the audit log (including the what/when/by whom):
- Site Enabled
- Site Disabled/Removed
- Site Subscription Method Changed