Breaking change for 8.1 wiki (Security > Administrators): The log format for failed logins has changed and uses now the remote address and is considering reverse proxies for such scenarios when configured correctly.
