btmp records failed login attempts.
utmp, wtmp, btmp and variants such as utmpx, wtmpx and btmpx are files on Unix-like systems that keep track of all logins and logouts to the system.
And btmp records failed login attempts.
you can use last -f /var/log/btmp command to view last failed login attempts.