The message type should be similar to below:
Successful Login:
%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: admin] [Source: 1.1.1.1] [localport: 23] at 16:33:14 PST Wed Jun 22 2011
Failed Login
%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: das] [Source: 1.1.1.1] [localport: 23] [Reason: Login Authentication Failed - BadUser] at 16:34:20 PST Wed Jun 22 2011
Ensure that you have enabled on the device:
login on-failure
login on-success
logging monitor 4
(config)#login ?
block-for Set quiet-mode active time period
delay Set delay between successive fail login
on-failure Set options for failed login attempt
on-success Set options for successful login attempt
quiet-mode Set quiet-mode options
logging host
You should see the data in the Syslog report generator under RME reports.
