Regardless of the Authentication Logs being enabled in Koha, when a user of the category type "staff" attempts to authenticate, it should always be logged. Ideally the length of the session should also be stored, but that may add complexity (I'm happy to open a new bug for length of session if that's the preference, please just let me know). This would help for any future security questions for libraries that don't enable those authentication logs by default, and also assist in making audits more straightforward.