observe ssh login attempts

All ssh events realtime:

sudo journalctl -u ssh -f

Auth log in realtime:

sudo tail -f /var/log/auth.log

Info about unsuccessful logins from file /var/log/btmp:

sudo lastb -n 20