In addition to what Polynomial has suggested, I'd recommend paying particular attention to the authentication attempt. i.e. logging the entire request (including the user-agent - not a unique identifier but a useful indicator) perhaps obscuring the password in a machine readable format(*). But also whether the attempt was succesful or not.
Since you should be changing the session id at an authentication attempt, you need to log both of these (regardless if successful). Tracking related content for the authentication page (jss, css, images) is also a useful measure, indeed, you might even consider spiking the page with non-cacheable content. Measuring the dwell time on the page is handy for detecting some kinds of attacks.
Measuring the time to generate the html as well as the time taken to offload it onto the client provides profiling information and detection of sloloris type attacks.
For pages other than the authentication page, then see Polynomial's list, and (where a user id is associated with a session, then the userid - e.g. see mod_auth_memcookie).
(*) i.e. with fields seperated and easily parseable