Ok I have queried user_events table, and see messages like PAM:Authentication, but nothing that indicates a failed login. Is there a ID field that translates to failed login, similar to how Windows has event ID's?