opensuse13.1 ( local IP 192.168.3.9 )
This is test enviroment:

MYWS[A.B.C.D]----INTERNET----->[PBLIC_IP]TP_LINK--->OPENSUSE(192.168.3.9)

From: MYWS i do
ssh -l root PULIC_IP
This is work -OK
If use incorrect password , then In the 192.168.3.9 i can see records:
/var/log/messages
Code:
.....
2017-06-11T14:03:02.873894+03:00 OPENSUSE sshd[4021]: #sshlog# A.B.C.D:22 root
2017-06-11T14:03:09.837633+03:00 OPENSUSE sshd[4021]: #sshlog# A.B.C.D:22 root edresf
2017-06-11T14:03:09.855976+03:00 OPENSUSE sshd[4021]: Failed password for root from A.B.C.D port 58526 ssh2
2017-06-11T14:03:10.731410+03:00 OPENSUSE sshd[4021]: Connection closed by A.B.C.D [preauth]
Sometimes such records don't appear ....;(

Only after:
Code:
/usr/bin/systemctl restart syslog.socket
All work OK again..
?
Any Suggestion , please.
About openuse:
Code:
# uname -a
Linux OPENSUSE 3.11.6-4-desktop #1 SMP PREEMPT Wed Oct 30 18:04:56 UTC 2013 (e6d4a27) x86_64 x86_64 x86_64 GNU/Linux
 # systemctl status syslog.socket 
syslog.socket - Syslog Socket
   Loaded: loaded (/usr/lib/systemd/system/syslog.socket; static)
   Active: active (running) since Sun 2017-06-11 13:49:24 EEST; 2min 43s ago
     Docs: man:systemd.special(7)
           http://www.freedesktop.org/wiki/Software/systemd/syslog
   Listen: /run/systemd/journal/syslog (Datagram)

Jun 11 13:49:24 OPENSUSE systemd[1]: Stopping Syslog Socket.
Jun 11 13:49:24 OPENSUSE systemd[1]: Starting Syslog Socket.
Jun 11 13:49:24 OPENSUSE systemd[1]: Listening on Syslog Socket.

# systemctl status rsyslog.service 
rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled)
   Active: active (running) since Sun 2017-06-11 13:49:24 EEST; 2min 54s ago
  Process: 37128 ExecStartPre=/usr/sbin/rsyslog-service-prepare (code=exited, status=0/SUCCESS)
 Main PID: 37133 (rsyslogd)
   CGroup: /system.slice/rsyslog.service
           └─37133 /usr/sbin/rsyslogd -n

Jun 11 13:49:24 OPENSUSE systemd[1]: Started System Logging Service.

# ls -la /var/log/messages
-rw-r--r-- 1 root root 1330103 Jun 11 14:07 /var/log/messages

 # rpm -qa | grep -i ssh
ssh-contact-0.7-6.1.3.x86_64
openssh-askpass-1.2.4.1-5.1.2.x86_64
openssh-6.2p2-3.1.2.x86_64
libnsssharedhelper0-1.0.10-6.1.2.x86_64
libssh4-0.5.5-2.1.2.x86_64
ssh-contact-service-0.7-6.1.3.x86_64
ssh-contact-client-0.7-6.1.3.x86_64
libssh2-1-1.4.3-7.1.2.x86_64


Serg