authentication failure: inner or outer?

Hi, my aim is to use linelog to log Access-Rejects differently when authentication fails because the user's home server says so from when it fails because "my" users type in a wrong password. If I'm not wrong the server (2.1.12) does not run the "Post-Auth-Type Reject" when in the inner tunnel, so how can I distinguish where the authentication failure happened? Thank you very much, Stefano