diff --git a/maxscale-system-test/CMakeLists.txt b/maxscale-system-test/CMakeLists.txt
index 29c24affb..42317b024 100644
--- a/maxscale-system-test/CMakeLists.txt
+++ b/maxscale-system-test/CMakeLists.txt
@@ -999,6 +999,9 @@ add_test_executable(mxs173_throttle_filter.cpp mxs173_throttle_filter mxs173_thr
  # https://jira.mariadb.org/browse/MXS-1889
 add_test_executable(mxs1889.cpp mxs1889 mxs1889 LABELS REPL_BACKEND)
 
+# MXS-421 Improved log facility
+add_test_executable(mxs421_events.cpp mxs421_events mxs421_events LABELS REPL_BACKEND)
+
 configure_file(templates.h.in templates.h @ONLY)
 
 include(CTest)
diff --git a/maxscale-system-test/cnf/maxscale.cnf.template.mxs421_events b/maxscale-system-test/cnf/maxscale.cnf.template.mxs421_events
new file mode 100644
index 000000000..5a00ba908
--- /dev/null
+++ b/maxscale-system-test/cnf/maxscale.cnf.template.mxs421_events
@@ -0,0 +1,42 @@
+[maxscale]
+threads=###threads###
+
+#event.authentication_failure.facility=LOG_AUTH
+#event.authentication_failure.level=LOG_ERR
+
+[MySQL-Monitor]
+type=monitor
+module=mysqlmon
+servers=server1
+user=maxskysql
+passwd=skysql
+monitor_interval=1000
+
+[RW-Split-Router]
+type=service
+router=readwritesplit
+servers=server1
+user=maxskysql
+passwd=skysql
+
+[RW-Split-Listener]
+type=listener
+service=RW Split Router
+protocol=MySQLClient
+port=4006
+
+[CLI]
+type=service
+router=cli
+
+[CLI Listener]
+type=listener
+service=CLI
+protocol=maxscaled
+socket=default
+
+[server1]
+type=server
+address=###node_server_IP_1###
+port=###node_server_port_1###
+protocol=MySQLBackend
diff --git a/maxscale-system-test/mxs421_events.cpp b/maxscale-system-test/mxs421_events.cpp
new file mode 100644
index 000000000..84da0da27
--- /dev/null
+++ b/maxscale-system-test/mxs421_events.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2016 MariaDB Corporation Ab
+ *
+ * Use of this software is governed by the Business Source License included
+ * in the LICENSE.TXT file and at www.mariadb.com/bsl11.
+ *
+ * Change Date: 2020-01-01
+ *
+ * On the date above, in accordance with the Business Source License, use
+ * of this software will be governed by version 2 or later of the General
+ * Public License.
+ */
+
+#include <stdlib.h>
+#include <iostream>
+#include <sstream>
+#include <string>
+#include "testconnections.h"
+
+using namespace std;
+
+namespace
+{
+
+string get_unique_user()
+{
+    stringstream ss;
+    ss << "mxs421_";
+    ss << getpid();
+    ss << "_";
+
+    for (int i = 0; i < 2; ++i)
+    {
+        ss << random();
+    }
+
+    return ss.str();
+}
+
+void connect_as_user(TestConnections& test, const string& user)
+{
+    MYSQL* pMysql = mysql_init(NULL);
+    test.assert(pMysql, "mysql_init() failed.");
+
+    if (pMysql)
+    {
+        const char* zHost = test.maxscales->IP[0];
+        int port = test.maxscales->rwsplit_port[0];
+        const char* zUser = user.c_str();
+        const char* zPassword = "nonexistent";
+
+        mysql_real_connect(pMysql, zHost, zUser, zPassword, "test", port, NULL, 0);
+
+        mysql_close(pMysql);
+    }
+}
+
+bool found_in_file(TestConnections& test, const string& file, const string& pattern)
+{
+    string command;
+    command += "fgrep ";
+    command += pattern;
+    command += " ";
+    command += file;
+
+    return test.maxscales->ssh_node_f(0, true, command.c_str()) == 0;
+}
+
+}
+
+int main(int argc, char* argv[])
+{
+    srandom(time(NULL));
+
+    TestConnections test(argc, argv);
+
+    test.maxscales->connect();
+
+    string user;
+
+    // Connect with an invalid user.
+    user = get_unique_user();
+    cout << "user: " << user << endl;
+    connect_as_user(test, user);
+    sleep(2);
+    // There should be an error in maxscale.log
+    test.log_includes(0, user.c_str());
+    // But not in /var/log/auth.log
+    test.assert(!found_in_file(test, "/var/log/auth.log", user),
+                "Unexpectedly found %s in /var/log/auth.log", user.c_str());
+
+    // Turn on 'event.authentication_failure.facility=LOG_AUTH'
+    test.maxscales->stop();
+    test.maxscales->ssh_node_f(0, true, "sed -i 's/#event/event/' /etc/maxscale.cnf");
+    test.maxscales->start();
+
+    // Connect again. This should cause an error to be logged to /var/log/auth.log
+    user = get_unique_user();
+    cout << "user: " << user << endl;
+    connect_as_user(test, user);
+    sleep(2);
+
+    // There should be an error in maxscale.log, as maxlog is not affected by the syslog setting.
+    test.log_includes(0, user.c_str());
+    // And in /var/log/auth.log as that's where authentication errors now should go.
+    test.assert(found_in_file(test, "/var/log/auth.log", user),
+                "Unexpectedly NOT found %s in /var/log/auth.log", user.c_str());
+
+    return test.global_result;
+}
+