audit logging

Hi,
Is defender audit logging resource intensive on a server or is it fully cloud based? Does the system send daily emails about changes?