It's tough for me to correlate your weblogs with what you should be seeing in Wordfence. If you have lockout set to say 3 attempts, and you see 3 attempts from an IP and then immediatelly check locked out IP's you should see the currently locked out IP listed there.
Under the "logins and logouts" tab in live traffic you should see the attempts listed there. If not, then let me know.
Regards,
Mark.