Logging Windows 2000 security events

We run W2000 on both clients and servers. The security logoff event (540) is not logging the User or machine name in the event log. Logons/offs from our one and only NT4 workstation are correctly recorded. We want to analysis machine utilisation andcannot because of the empty entries. Please can anyone help?