I can't see in the syslog when a user accesses a Cisco 6509 (12.2 (17r) S4). This is the configuration that I used.
logging trap informational
logging facility local6
logging source-interface Vlan99
Someone can help me?
It's an enhancement in IOS 12.3(4)T and later:
login on-failure log
login on-success log
with pre-requisite of "login block-for seconds attempts tries within seconds"
Otherwise, you need to look at the logs of your AAA backend.