Cisco ASA Logging of Bad Password Attempts

[prosyspath]

I am trying to log "Bad Passwords" or "Access Denied" attempts on the ASA and alert on them with Splunk:

I have the Cisco ASA 5510 Syslog setup and pointed to Splunk and I am getting data into Splunk but cannot search and see find the bad password attempts. I am running Cisco 8.2.1 I have changed the logging trap warnings to notifications with no effect.

logging enable
logging console notifications
logging trap warnings
logging device-id hostname
logging host inside 10.1.100.110

[krugger]

You should be looking for:

%ASA-6-605004: Login denied from source-address/source-port to interface:destination/service for user “username”

%ASA-6-605005: Login permitted from source-address/source-port to interface:destination/service for user “username”~

Log level has to be set to informational. Event ID is 605004.