There are now two approaches about logging authentication efforts: the traditional approach is to use the capability of AAA to an authentication server and the authentication (both successful attempts and failed attempts) can be seen on the server. In recent releases of IOS Cisco has added the ability to generate similar information through syslog. It appears that you are using the second approach. Can you confirm which approach you are using?
If you are using the second (syslog) approach can you post what you have put into the configuration to generate these logs? Can you also give us the version and feature set of the image that you are running? (would want to verify that the new feature is supported in the code that you are running)
Thanks for posting the additional information. From what you posted I do not believe that you have configured anything that would send login information to syslog. As I indicated in my previous post there are 2 alternatives about getting information about login activity (successes or failures). One approach is to get the information from the ACS server (which assumes that you are using AAA to control loging and that you are using an ACS server). The other approach which is quite new is to send the login activity message to syslog. To use this new feature you need to configure:
login on-success log [every login]
login on-failure log [every login]
This link will give more information if you want more detail about it.
After reading Rick's posts, just realized I misread your orignal post. Thought you were not getting any logging.
If supported on your router/IOS, Rick's info appears the most suitable. Otherwise, AAA accounting may help you but its been a while since I've last used it. I do recall it will log to the AAA server, don't recall if they also syslog.
aaa accounting network acct_tac1 stop-only group tacacs+ group radius
aaa accounting network default stop-only group radius
We are pleased to announce availability of Beta software for 16.6.3. 16.6.3 will be the second rebuild on the 16.6 release train targeted towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are looking for early feedback from custome...