How to capture a login event?

[Zachary Shay]

I am fairly new to the linux audit subsystem, and have a question that 
can probably be answered in a one line response.  I'm trying to detect 
when logins (successful) and login attempts (unsuccessful) occur using 
the auditing subsystem.  Is there an auditing rule that can do this?  My 
brief research has shown a syscall, setauid(), available in BSD and 
SysV; however, it isn't implemented in linux.  Also, a rule watching the 
file "/proc/self/loginuid" will show every time the pam_loginuid.so is 
called by a point of entry...unfortunately that isn't useful because the 
uid/euid/auid is always bound to root.  Any ideas?

Thanks in advance,
Zach