This question already has an answer here:
I have a public-facing web application where anyone can register an account. The passwords I store are salted and hashed.
When someone tries to overtake the account of someone else through guessing passwords I would like to know this. For that reason I would like to log all unsuccessful login attempts.
I think that it wouldn't be a problem to log time, IP address and attempted username. But would it be acceptable to also log the wrong password in clear-text so I can detect the patterns the attacker is trying, or would the risk of being able to deduce correct passwords from misspelled login attempts by legitimate users too big?