Totally agree.
Sometimes I watch my live logs of auth.log of about 100 public servers. I am probably see 10 port scans or ssh attempts per second from random machines. Nothing to worry about if machines setup correctly.
More worrying are the people who try to break our public APIs. Either by letting it to crash, brute force operations etc.
The security flaws are often inside the software domain layer.
Wow. I'm looking at only one of my servers and there is a root login attempt every second. I feel a little embarrassed I am surprised by this.
IPs on the log files most likely are exit proxies if those attackers were not rookies. Simply change the SSH port only would deter 90% of those attempts per my personal experience.
while I'm not the greatest fan of fail2ban ever, though I do use it on some public facing servers, it also has the option for "recidivism" which means that an IP that repeatedly gets itself banned will be banned for an even longer duration, which at least cuts down on the log file clutter somewhat.
getting scanned and probed by peoples' automated tools looking for vulnerabel daemon RCEs has been a log clutter issue for about 25 years or more now. it's part of the background noise of the internet. ever since the days of having your http daemon logs cluttered up with GET DEFAULT.IDA stuff and similar in 2001.
https://www.google.com/search?client=firefox-b-1-d&q=get+def...
put more effort into ensuring that public facing daemons are totally up to date and hardened against external compromise. Or better yet don't have them public facing at all, if you can admin your server via an ssh daemon that only listens on a logical vpn interface or some sort of OOB interface.