Purpose

If you want to get a list of users that did a failed login before, it is possible to find out by running SQL queries against your database.This is particularly useful if you have a large number of users.

Confluence database has a counter of how many failed login that each user experiences.

Solution

You may need to modify these queries for your particular database. 

List users that has experienced failed login:

select 
a.CURFAILED as Current_failed_logins,
a.TOTALFAILED as Total_Failed_logins,
a.SUCCESSDATE,
a.FAILEDDATE,
b.username
from logininfo a
join user_mapping b
on a.username = b.user_key
where a.CURFAILED != '0' 
or a.TOTALFAILED != '0' ;

Current_failed_logins will show the number of current failed login attempt while Total_Failed_logins will show the number of accumulated failed logins the user had before. Current_failed_logins will reset the counter back to 0 whenever the user has successfully logged in to Confluence.

For example,

• If a user has 5 Total_Failed_logins but 0 Current_failed_logins, this means that the user had 5 failed logins in the past but the last login they performed was a successful one and they're able to access Confluence.
• If a user has 3 Total_Failed_logins and 3 Current_failed_logins, this means that the user has 3 failed logins to Confluence and is currently unable to access Confluence.