The log file you are looking for is /var/log/auth.log.
More information can be found in this KB article, https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=20048...
