i found /var/log/secure but here only logging connect time (also without successful/unsuccessful)
Do you mean the .bash_history files? You will find them in the /root and /home/username directories.
Mike WHM and cPanel Scripts (join our "Scripts Club") D/A Photography