What would be the best way to check failed password attempts? For instance:

Failed password for root from 61.177.172.32 port 48160 ssh2

. (from /var/log/auth.log)