In time, any server with port 22 exposed to the Internet will have a system log with hundreds of failed authentication attempts per minute from IP addresses all

In time, any server with port 22 exposed to the Internet will have a system log with hundreds of failed authentication attempts per minute from IP addresses all over the world. By simply moving it to a high port number, the attempts are rare and troubleshooting is easier without all the noise. And it is script kiddies, typically the login is root, ubuntu, or similar and a password of password, god, other silly things that people actually use.