The ssh daemon,
sshd, has much of this built in and enabled. Here's are some sample lines from
/var/log/secure on my machine (names and IP addresses changed):
Sep 7 08:34:25 myhost sshd: Failed password for illegal user root from 62.75.999.999 port 52663 ssh2
Sep 7 08:34:26 myhost sshd: User root not allowed because listed in DenyUsers
Sep 7 08:34:28 myhost sshd: Failed password for illegal user root from 62.75.999.999 port 53393 ssh2
Sep 7 11:55:18 myhost sshd: Accepted password for gooduser from 98.999.26.41 port 43104 ssh2
Sep 7 23:01:28 myhost sshd: Did not receive identification string from 918.104.22.1689
Sep 8 06:31:30 myhost sshd: Accepted password for gooduser from 98.999.26.41 port 5978 ssh2
This example shows a couple attempts by somebody to ssh into this machine as root -- both were denied because root is forbidden. It also shows a successful login by the user named "gooduser".
To fine tune what you see and in which file, read more in the sshd_config man page -- specifically the options for LogLevel and SyslogFacility.