I have v13.6.2.
When a user tries to log in with an incorrect password the log just shows
**** for the password.

In my case this is most commonly due to brute force attack and not due to legitimate users trying to log on.
Is there any way to get the log to show the password attempts as it did in earlier versions, so that I can ***** the effectiveness of the attack.

Previously they would be simple dictionary attacks for generic user names, but now come as a few attempts from Russia and Ukraine from various IP's and targeted at real user names. I need to know if the attempted passwords are close to our current password policy.

Failing this I would suggest a new stratagy, as the attacker switches IP when they are locked out, probably the task is passed onto the next member of a botnet, if I could block the IP but not tell the attacker that they were blocked (simply reply wrong password) then they would exhaust their attack thinking that all passwords had failed even if they do hit the right password. A genuine user would not attempt more that 10 passwords before giving up and contacting support.