pfSense

SSH authentication failures currently go to the System log. With its limit of displaying 50 lines, only a handful of authentication failures will fill this log, obscuring other System messages. Therefore, I would like to request that a separate authentication log be used (similar to the de facto auth.log) for such things.

One can try to work around this by restricting where SSH can come from (via a filter), moving SSH to another port, or turning on cert-only authentication (to reduce the number of lines in the log from auth failures), but that only sidesteps the issue.