Authentication/Authorization events are logged by the EJB2/Web interceptors in audit.log.

The EJB3 interceptors should do the same.

I was of the impression that this was already done, but somehow the entries are not seen for ejb3.