[Bro] Question on quick start documentation SSH:Login example.

[James Lay]

On 2014-08-06 15:02, nithen wrote:
> On 8/6/14, James Lay wrote:
>> Would that be in the ssh.log or the notice.log?
>
> Thanks James, I checked both (actually all logs) and mail -> my 
> novice
> assessment was notice.log to answer your question - am I correct?
>
> N

Good call on checking.  Per the html:

http://www.bro.org/sphinx/scripts/policy/protocols/ssh/detect-bruteforcing.bro.html

It looks like unless it's redefined, these should show up in 
notice.log...but I'm a noob, so someone smarter then me on this list 
should be able to verify that.

James