The login provider can emit event log entries which say who logged in and when, and reasons for login failure etc.

Those entries aren't plain text - they are protobufs decoded by a google-provided dll file. If event viewer is open, it won't load that dll, and it will fail to render any event log entries for logins until it is restarted.