[nkozyra]

That's a great point, but I get back to the root question: who's actually looking at this? If people are examining logs it's usually for a particular trigger or a problem and filtering that signal from the noise is hard.

[Sohcahtoa82]

Likely, nobody is directly looking at the logs.

But they might be using software that automatically raises an alert when it sees repeated login attempts for a valid username.

Isn't that one of the purposes of Splunk?

[thelamest]

It's more typical of the servers-as-pets than servers-as-cattle scenario, but sometimes one is simply curious [or extra cautious]. SSH honeypots exist at least in part for this reason.

[boojums]

> servers-as-pets This is a great way to put it.

[jldugger]

> who's actually looking at this?

Well, your security team, post incident. But also automated systems like fail2ban.

[warrenm]

And log-collectors like Splunk (with configured alerts, etc)