First questions (Audit Log, Radius passthrough to RSA and so on .. )

Yes.
Audit menu (top, second last) will show you all successful and failed user logins.
Client IP addresses will show up instead of 127.0.0.1…