Ubuntu Server with Apache, hosting multiple websites and mail-servers.
/var/log/auth.log, are there other places where break-in attempts are logged?
Context: I used to have a lot of break-in attempts. Then I disabled password login for root. Now, I only log into root via SSH keys. Plus there are no non-root user accounts.
I don't see break-in attempts in
/var/log/auth.log any more. This is odd to me because I'm aware of people still trying to break into my server.
So my question is, under my new authentication mechanism:
is it that "would-be-breakers" are unable to get to the point in my server where their attempts would be logged?
or is it that I'm looking in the wrong log file (
If (2), then where should I be checking for break-in attempts?