Working as a sysadmin, and with disk encryption the constant log writes generated from ssh has been enough to cause some heavy load on severs. Long lasting connections from bots also forced is to increase the maximum number of sockets. Fail2ban has mitigated those issues to the point where neither has been an issue.