In order to debug unsuccessful logins, log the reason (like the LDAP response). To gather statistics, also log successful logins (with a keyword that can be easily `grep`ped).