When using NIOS Identity Mapping, you need Kerberos auditing logs to be enabled on the domain controllers to get event_id 4624, event_id 4634 plus others.

event_id: 4624 identifies the user, IP address, first seen and last seen