Ah, you are talking about querying auth attempts? You may need to modify the asl config to make that available.