Yes. But on the other hand you don't want the log file to potentially contain the passwords, which would happen if someone botched the login and sent the password instead of the username.
What I think might be a viable compromise could be to log:
- attempts with valid usernames and invalid passwords, logging the username but not the password.
- attempts with invalid usernames (which might be passwords or whatever), logging the username as "INVALID".
The rationale is that several attempts with a single valid username will tell you of a possible bruteforcing against that username; a swarm of attempts against the INVALID username will warn of a large-scale "username with obvious password" attack, which, if you have a proper password policy, is irritating but harmless. Even more so the attempts against well-known users.
It is conceivable that someone might be attempting to bruteforce a single invalid username; if that's a concern, you might log invalid usernames as (partial and/or salted) hashes. The value of this cleartext information, even if captured by hostile parties, would be essentially nil.
A very small number of attempts on the INVALID username may be due to users misspelling their own names, or entering the password instead of the name; or paranoids that intentionally botch their first login believing this to protect against credential capture.
Especially if quickly followed by a valid login from the same address (unless it's a system masquerading a large network...), an occasional authentication error of this kind could be considered noise and ignored.
(You might further distinguish a small set of "valid invalid names" such as info, admin*, Administrator, guest, if you wanted, but that's probably overkill).
Also, for the truly paranoid, you could pad all valid usernames and the string "INVALID" to be the same, fixed length (say... 20 characters?). If by any chance an attacker could be able to remotely observe the log file's growth, he would thus be unable to tell whether a username was existing or not on the system.