The command you're looking for to log telnet or ssh logins would be one of the following depending on your needs:
login on-failure log login on-success log
That would cover successful or failed logins regardless of whether it was telnet, ssh, or console. So it wouldn't log failed connection attempts to the telnet or ssh port. To do that you would create an access list to deny telnet or ssh traffic and add "log" to the end of the ACL statement to log those also.
Then you need to have your router send syslog messages to MARS.
All of these commands were examples from one of my routers that is running AAA. I'm almost positive that you don't need to have AAA enabled in order to use the "login on-failure" or "login on-success" features, but if you're running recent code and it still isn't working try turning on AAA.
One solution would be to use an ACLs on the VTY with logging. This will at least get the source IP addresses of all attempted telnet connections. You can do this by:
1) Create a standard ACL. Add applicable permit or deny statements based on which traffic you want to all. To catch failed telnet attempts, add the "log" option to the end of the deny statements. Example:
ip access-list standard TELNET-ACL
permit 192.168.100.0 0.0.0.255
deny any log
2) Apply the ACL to the VTY interfaces. Something like this (acl named TELNET-ACL):
line vty 0 15
access-class TELNET-ACL in
transport input telnet
That will create logs that will be sent to MARS, plus it's a good security practice that should be used when possible.
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...