Where do I find the logs for OS X authentication attempts?
It's found in the secure.log (the path is /var/log/secure.log) and the entries would look something like this:

authorizationhost[5917]: Failed to authenticate user &lt;cksum&gt; (error: 9).


It does not log password attempts (the password they tried to use), just the actual unsuccessful (or successful) login attempt.

Additionally, to focus your search exclusively for failed login attemps, open Terminal.app (found in Utilities folder) and run the following command: 

sudo grep 'Failed to authenticate' /var/log/secure.log