SYSLOG events have been added for SQL user logon and logoff events, as well as failed logon attempts. These are included in the USER_INFO option with other system logon/loggof events.
Add SYSLOG USER_INFO to your ctsrvr.cfg configuration to enable logging of these events to the SYSLOG event logs.