Sure you can ... configure your PIX to send traps to a syslog server .. the event you need to send/look for is
109011: Authen Session Start: user '****', sid 254
the config on your PIX should like like this:
logging on
logging timestamp
logging monitor warnings
logging buffered notifications
logging trap notifications
logging history warnings
logging device-id ipaddress
logging host
Hope it helps .. please rate it if it does !!!
