By default CAS includes log4j. However, you can remove that and use whatever you want (as long as Commons Logging supports it). This section assumes you're still using log4j.
The log4j configuration file is located in ${project.home}/cas-server-webapp/src/main/webapp/WEB-INF/classes/log4j.properties. By default logging is set to INFO for ja-sig code and WARN for Spring code. While debugging you may want to set those to DEBUG. When in production though, you probably want to run them both as WARN. Depending on your needs, it may make sense to keep the defaults (INFO and WARN).