Only successful logins and logouts — the tab's query is hard-filtered to those two event types, so nothing else can appear there, even through the search box. Two-factor authentication events (2FA turned on, 2FA turned off, a failed 2FA code, a recovery code used) are written to the same underlying activity record, but in the current version there is no tab in System Logs that surfaces them — they're captured but not visible anywhere in the admin screens.