crazy hackers and logwatch

[David D. Hagood]

That's also why I don't put SSH on the standard port - that raises the 
bar so that the average script kiddie won't find it, and thus filters 
out the bulk of the crap.

Of course, that is no substitute for taking other security measures, 
such as locking out hosts that have too many login failures, requiring 
the use of keypairs rather than using password authentication, and so on.