I don't use pppd I have a working ethernet modem/router
maybe someone can make sense of this, assuming you have syslog bootcode
strings /usr/local/sbin/pppd | grep log
getlogin
openlog
closelog
syslog
setlogmask
reopen_log
pap_logout_hook
logwtmp
log_default
dbglog
tdb_logging_function
end_pr_log
log_to_fd
init_pr_log
uselogin
Don't output passwords to log
Show password string in debug log messages
@login
/var/log/lastlog
user %s logged in
login failed
No secret found for PAP login
unable to open user login data file %s
unable to read user login data file %s
Can't open log file %s: %m
logfile
nolog
nologfd
Set logical name for link
Append log messages to this file
Send log messages to this file descriptor
Don't send log messages to any file
Don't send log messages to any file descriptor
/var/log/wtmp
E=646 Restricted logon hours
/var/log/lastlog + /var/log/wtmp suggests look there first?