If there are logon failures then I'd usually expect to see something in the logs but they can be quite time consuming to troubleshoot. In situations like this, I'd say there are two ways to start looking for clues:
1. Open a command prompt or shell on your Foundation Services box and cd to C:\Oracle\Middleware\user_projects\epmsystem1\bin (or the equivalent)
2. Run loganalysis.bat / loganalysis.sh with the ecid flag to trace the ecid session ID in the error (e.g. loganalysis.bat -ecid "0000KIAA2Wq8Pt^5xVXBiW1J57mF0000C1,0")
3. See if the report (usually somewhere like C:\Oracle\Middleware\user_projects\epmsystem1\diagnostics\reports) can give you any more detail.
If that doesn't give any more detail I would then use OS text processing tools on the ziplogs output:
1. Run ziplogs.bat (or ziplogs.sh depending on OS) to collect the logs for the system - see http://docs.oracle.com/cd/E40248_01/epm.1112/epm_troubleshooting.pdf
2. Unzip the logs somewhere.
3. Open a command prompt or shell and cd to the folder with the unzipped logs.
4. Run something like findstr /m /s /c:"2014-03-03T14:54" or grep -irl "2014-03-03T14:54" to list files containing the time stamp where the error occurred (to the minute level). That should hopefully narrow down which logs contain anything around the time the problem was seen.
Hope this helps