Search notes:

/var/log/btmp

/var/log/btmp records bad login attemps.
The wtmp file records all logins and logouts.

Format

Its format is exactly like utmp except that a null username indicates a logout on the associated terminal
file interestingly reports it to be a dBase III file:
$ file /var/log/btmp
btmp: dBase III DBT, version number 0, next free block index 6

See also

/var/log
/var/log/wtmp, /var/log/lastlog, /var/log/faillog

Index