cd /var/log ls
here you find text files that contain a detailed log of various activities
edit this file
sudo nano /etc/ssh/sshd_config
goto the line and remove the hash key
# Logging
SyslogFacility AUTH
LogLevel VERBOSE
Press Control S to save and Control X to exit
restart ssh
sudo systemctl restart ssh
check in terminal
Open 2 terminals side by side, on the left terminal type this command
and on the right terminal try to login with a fake-user account
watch tail /var/log/auth.log
Press control C to exit the watch screen
watch tail /var/log/apache2/access.log