Probably a silly question but anyone know where failed logins are buried? .. logging's cranked up to debug across the board but I just don't see the relevant events anywhere.
v7.0.2 if it makes a difference.
You should use the audit logging to derive such information.
Refer to audit even type LOGIN
There is audit events report that you can modify to suite your needs.
If you want to dig into the database, look for the T_AV_USER_CHANGES_LOG table.
Retrieving data ...