Just to be safe, the logging in my current app does not store parameters passed to login or password-reset methods. The log call has an optional parameter that controls this, which, when set to true, replaces the stored parameters object with [Redacted]
. Sure, so I miss out on a little data, but I have their IP addresses, and I'd rather not risk getting something that sensitive in plaintext.
If you really want to log this kind of thing, I'd suggest that when logging a login attempt, you check the database for users with a name matching what you have in the username field, and only store it if you have a match. Otherwise, you just store it as "unknown user". You could get fancy, checking if this value contains that or whatever, but there's always the risk that you get combinations like [User][Password] and [UserPas][sword], in which case you can check against the IP and deduce that you've inadvertently stored the start of someone's password in the clear. You could extend this to the unlikely-but-possible [User][Password] and [UserPassword][??], in which case you can see "unsuccessful login by UserPassword" followed by "Successful login by User" and deduce all of User's password. Generally, to be safe I'd say to not log usernames unless the login is successful.
Edit to add:
Most of the arguments people are posting for logging the username for failed login attempts are, in my opinion, better handled through other methods.
For example, it's been said that when a customer asks "why can't I log on?", logged usernames would allow you to point out typos. This is true, but it's not worth the risk of also catching passwords; I'd do this by instead redirecting the user back to the login form on failure, highlighting the username field and repopulating it with whatever they typed so that they can see for themselves.
Another argument was that it lets you identify hacking attempts; a string of failures against one username may well be an attempt to brute-force a password. I'd do this by having a "BadLogins" column on the Users table, which is incremented each time a login fails with a username matching this user, and is reset to zero on a successful login, after telling the user "there have been x unsuccessful login attempts since your last login" and advising them on what to do if they don't think the attempts were from them. If you want to be really thorough, you could have another column that stores the last value of the BadLogins column even after the successful login, and/or a column that stores the highest-ever value of this column, and/or a column that stores the total number of failed logins this account has ever had.