Originally Posted by falko
Ok, your system is logging to /var/log/secure instead of /var/log/auth.log.
my /var/log/secure doesn't contain logs of SSH connections, all lines are like :
Dec 5 13:55:25 localhost proftpd .....
any clues how/where to look for log of SSH connects as DenyHosts has blocked 3 IP's and I want to investigate why