I have Log Forwarder on our spiceworks server currently enabled with a security subscription, but I'm not sure if I'm getting logon events or not.
To see logon events, you will want to make sure that Audit Success is selected. Please note that in Windows 2008, this will be selected under the Keywords drop down menu.