Failed login attempts are logged in /var/log/btmp file. For security reasons, it is recommended to set default permission 0600 on the /var/log/btmp file.
Secondly, the file should be owned by the root user. Some services like sshd do not work, if the default permission of the file is changed.
The following error may be observed if permission is set other than the default.
Excess permission or bad ownership on file /var/log/btmp
