AAA audit will show you the passed and failed authentications. TACACS accounting will show you when sessions started, when they ended, and how long they were open. And if you are doing TACACS command accounting, it will show you the commands that were used by the user.