diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/UsernamePasswordRealm.java b/java/com.sap.sse.security/src/com/sap/sse/security/UsernamePasswordRealm.java
index 5327b50a6a1..bfeb3b3a8f7 100644
--- a/java/com.sap.sse.security/src/com/sap/sse/security/UsernamePasswordRealm.java
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/UsernamePasswordRealm.java
@@ -1,5 +1,7 @@
 package com.sap.sse.security;
 
+import java.util.logging.Logger;
+
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
@@ -7,12 +9,14 @@ import org.apache.shiro.authc.LockedAccountException;
 import org.apache.shiro.authc.SaltedAuthenticationInfo;
 import org.apache.shiro.authc.UsernamePasswordToken;
 
-import com.sap.sse.security.shared.Account.AccountType;
-import com.sap.sse.security.shared.impl.User;
 import com.sap.sse.security.interfaces.SimpleSaltedAuthenticationInfo;
+import com.sap.sse.security.shared.Account.AccountType;
 import com.sap.sse.security.shared.UsernamePasswordAccount;
+import com.sap.sse.security.shared.impl.User;
 
 public class UsernamePasswordRealm extends AbstractCompositeAuthorizingRealm {
+    private static final Logger logger = Logger.getLogger(UsernamePasswordRealm.class.getName());
+
     public UsernamePasswordRealm() {
         super();
         setAuthenticationTokenClass(UsernamePasswordToken.class);
@@ -46,6 +50,7 @@ public class UsernamePasswordRealm extends AbstractCompositeAuthorizingRealm {
             return null;
         }
         if (user.getLockingAndBanning().isAuthenticationLocked()) {
+            logger.warning("Rejected attempt to authenticate user "+username+" because it is locked: "+user.getLockingAndBanning());
             throw new LockedAccountException("Password authentication for user "+username+" is currently locked");
         }
         final UsernamePasswordAccount upa = (UsernamePasswordAccount) user.getAccount(AccountType.USERNAME_PASSWORD);
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
index cde8b92f2c2..7292abf8465 100755
--- a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
@@ -1291,6 +1291,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
             lockingAndBanning = user.getLockingAndBanning();
             lockingAndBanning.failedPasswordAuthentication();
             store.updateUser(user);
+            logger.info("failed password authentication for user "+username+"; locking: "+lockingAndBanning);
         } else {
             lockingAndBanning = null;
         }
@@ -1329,6 +1330,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
     public LockingAndBanning internalFailedBearerTokenAuthentication(String clientIP) {
         final LockingAndBanning lockingAndBanning = clientIPBasedLockingAndBanningForBearerTokenAuthentication.computeIfAbsent(escapeNullClientIP(clientIP), key->new LockingAndBanningImpl());
         lockingAndBanning.failedPasswordAuthentication();
+        logger.info("failed bearer token authentication from client IP "+clientIP+"; locking: "+lockingAndBanning);
         scheduleCleanUpTask(clientIP, lockingAndBanning, clientIPBasedLockingAndBanningForBearerTokenAuthentication,
                 "client IPs locked for bearer token authentication");
         return lockingAndBanning;