the username should be logged by default in the access.log logfile. the property "authentication.username" contains the authenticated user for that request.
An account that many people also use, how do I lock the account if they share the same?? (lock automatic).
At now, I used the report to examine the use of internet, then if that user used on many different computers, I lock account but it takes more time.