authentication failure: inner or outer?

[Stefano Zanmarchi]

Hi,
my aim is to use linelog to log Access-Rejects differently when
authentication fails because the user's home server says so
from when it fails because "my" users type in a wrong password.
If I'm not wrong the server (2.1.12) does not run the
"Post-Auth-Type Reject" when in the inner tunnel, so how
can I distinguish where the authentication failure happened?
Thank you very much,
Stefano