Some high security organizations require that applications adhere to NIST 800-53. Prior to version 8.8, users were able to find the source IP for logins in the auth.log and audit.log files but the log files no longer contains the source IP for HTTP login events.
Aria Operations for Logs 8.10.x - 8.18.x
The source IP for HTTP login events is slated to return in version 9 of the Aria Operations for Logs.