Yep. Especially if there's a suspected incident or a new vulnerability announced, I'd much rather be reading port 2234 sshd logs that port 22 sshd logs - far l

Yep. Especially if there's a suspected incident or a new vulnerability announced, I'd much rather be reading port 2234 sshd logs that port 22 sshd logs - far less haystack to wade through looking for needles. And as another comment mentions, every time an sshd zero day is announced, pretty much the entire IPv4 address space gets probed on port 22 within about 30 minutes. A non standard port number _might_ buy you an extra hour or three if you've got a vulnerable sshd. But don't rely on that - someone's bound to have portscanned you recently enough and knows you've got OpenSSH_8.2p1 listening on port 2234 (or whatever) and they won't be far behind the whole-internet port 22 exploit probes.