To prevent a potential security breach, verify that the login attempt was made by an authorized user. You can check /var/log/syslog.log and /var/log/hostd.log for both successful and failed login attempts. The /var/log/vobd.log file also contains logs for failed login attempts. This /var/log/vobd.log is knows as observation log in ESXi.
Also Viewable at:-