Unsuccessful attempt to login is stored in the database with timestamp. Invalid and expired tokens submitted to the application are categorized as authentication failures and the same are logged.