To prevent a potential security breach, verify that the
login attempt was made by an authorized user. You can
check /var/log/syslog.log and /var/log/hostd.log for both
successful and failed login attempts. The /var/log/vobd.log file also contains
logs for failed login attempts. This /var/log/vobd.log is knows as observation log in ESXi.
Also Viewable at:-
https://YOURESXhostIP/host/vobd.log