You know, there's way less hacky solutions to this problem than SSH logs. Set up iptables to log scan attempts specifically targeting your server.