Currently one will see an exception in the debug log if one enters a wrong password on http://server:9090/. That's just fine but a very long log message and the only indication that one did try to access the web admin console.
The access to the web console or at least the (failed) login should be logged somewhere (info.log).