Customer would like to create a report from multiple SQL Server instances hosted by different server that captures the "Login failed" event.
The event is visibly available in both the SQL Server event log and SQL Server error log. Yet, going through the Foglight report wizard, metrics aren't found pertaining to "login failed' even outside the alarm metrics.
RMI calls are skipping the DMS Rep and brings back answers directly on screen
Create a customer user defined collection to achieve the information that you are looking for.
There may be a couple workaround solutions you could investigate including an undocumented SQL Server system stored procedure sp_readerrorlog. This SP allows you to read the contents of the SQL Server error log files directly from a query window and also allows you to search for certain keywords when reading the error file. When this gets called it calls an extended stored procedure xp_readerrorlog.
There also might be a standard report in SQL Server Management Studio. These may be available by right-clicking the Logins node underneath the Security node. From the menu that appears, click the Standard Reports, and then select "Login Failures". This report shows information about login attempts that have failed. It shows historical information on these attempts, gathered from the Event Logs.
Someone in the Foglight Communities recently worked on such an effort (ref: http://communities.quest.com/thread/16154) to find error log entries based on a search pattern.