i suspect you are just not looking at the right file (auth log vs. a daemon log) and are only looking at the authentication requests that get passed down to you

i suspect you are just not looking at the right file (auth log vs. a daemon log) and are only looking at the authentication requests that get passed down to your authentication library (pam?).