I'd like to add that in my experience simply moving SSH to a port other than 22 reduces the volume of breaking attempts low enough that it's viable to see thing

I'd like to add that in my experience simply moving SSH to a port other than 22 reduces the volume of breaking attempts low enough that it's viable to see things in the log.