I'm not sure if they are stored in a file, but you can access the 802.1x wired logs with the following terminal commands:
View last 24 hours of logs
log show --predicate 'subsystem contains "com.apple.eapol"' --info --debug --last 24h
Stream the logs in real-time
log stream --predicate 'subsystem contains "com.apple.eapol"' --info --debug
I cant recall if this contains the 802.1x wireless logs in there as well, but it definitely has the wired logs as I recently used the real time command above to troubleshoot a 802.1x wired ethernet issue.
Hope that helps.
Thanks @johnsz_tu What was the issue for you on wired 802.1x? We have seen a time when the client will re-authenticate and offers it's MAC address instead of the client cert to ISE and so hits the wrong rule and doesn't get access to anything