I've created a pretty decent server side trace script that does a good job of auditing login info;

it definitely captures failed logins, as well as all these events:

--Audit Add DB User Event

--Audit Add Login to Server Role Event

--Audit Add Member to DB Role Event

--Audit Add Role Event

--Audit Addlogin Event

--Audit Login

--Audit Login Change Property Event

--Audit Login Failed

--Audit Login GDR Event

--Audit Logout

--Audit Schema Object GDR Event

--UserConfigurable:4

mylogonTrace.sql.txt

from there, i usually create a view for every trace i create so that i can easily look at the results

here's teh base of the needed SQl :

--SELECT * from sys.traces

declare @TraceIDToReview int

declare @path varchar(255)

SET @TraceIDToReview = 2 --this is the trace you want to review!

SELECT @path = path from sys.traces WHERE id = @TraceIDToReview

SELECT

TE.name As EventClassDescrip,

v.subclass_name As EventSubClassDescrip,

TE.*,

T.*

FROM ::fn_trace_gettable(@path, default) T

LEFT OUTER JOIN sys.trace_events TE ON T.EventClass = TE.trace_event_id

LEFT OUTER JOIN sys.trace_subclass_values V

ON T.EventClass = V.trace_event_id AND T.EventSubClass = V.subclass_value