> Isn't watching failed logins kind of useless? I think it is more important to see what successful logins were made. Are you talking about Fail2Ban? I'm not

> Isn't watching failed logins kind of useless? I think it is more important to see what successful logins were made. Are you talking about Fail2Ban? I'm not an expert but my guess is that it's defense in depth. Rate limiting failed logins is useful in the case where you messed up somewhere else and have a service/login that is vulnerable to password guessing. I would imagine that auditing successful logins is definitely useful but was left out of the guide for brevity.