/var/log/faillog

/var/log/wtmp, /var/log/lastlog, /var/log/btmp

/var/log/faillog is the failure login file. This is a binary file. The content can be examined with faillog.

The -l flag in useradd.

Security: log files