Stabndard user does log an audit action on failed logins.
I think that the standard classes defined in ez as alternative login handlers should do the same if auth fails at both ends (local and remote)