A viable compromise could be to log:
- attempts with valid usernames and invalid passwords, logging the username.
- attempts with invalid usernames, logging the username as "INVALID".
(You might further distinguish a small set of "valid invalid names" such as info, admin*, Administrator, guest, if you wanted, but that's probably overkill).
The rationale is that several attempts with a single valid username will tell you of a possible bruteforcing against that username; a swarm of attempts against the INVALID username will warn of a large-scale "username with obvious password" attack, which, if you have a proper password policy, is irritating but harmless. Even more so the attempts against well-known users.
It is conceivable that someone might be attempting to bruteforce a single invalid username; if that's a concern, you might log invalid usernames as (partial and/or salted) hashes. The value of this cleartext information, even if captured by hostile parties, would be essentially nil.
A very small number of attempts on the INVALID username may be due to users misspelling their own names, or entering the password instead of the name; or paranoids that intentionally botch their first login believing this to protect against credential capture.
Especially if quickly followed by a valid login from the same address (unless it's a system masquerading a large network...), an occasional authentication error of this kind could be considered noise and ignored.