Event ID 4625

I have purposefully typoed a password to see if the event log consolidator logged that ID.  Win2k8R@ I cannot find it anywhere.  I do see the failed logon with my Win2K3 server.

Can anyone tell me the reason why, and how can I have that id appear and alert?  I have tried custom filters by event id, with no luck