It will depend a bit on your architecture. Are you using Unified Access Gateways (UAG), Security Servers or something else?

The connection servers should have this information. You will need to configure the connection servers to send the logs to a syslog server or write to a file.