Hi,

login via ssh (putty) to a SLES 12 SP4 Server gave me these messages:
"login as: root
Using keyboard-interactive authentication.
Password:
Last failed login: Sat Mar 14 23:39:31 CET 2020 <===============
There were 136 failed login attempts since the last successful login. <=====================
Last login: Sat Mar 14 22:48:58 2020 from 146.107.158.156
ha-idg-1:~ #"

I never got messages like that before.
The host is running fine for already several months and not accessible from the internet.
Neither /var/log/messages nor lastlog gave me any clue for the reason for that.
In /var/log/messages i don't find any information at the timestamp 03/14/2020 23:39:31 !?!
Where/what else can i look for ?
Is it helpful to install fail2ban, for what reason ?

Bernd