Lots of disconnect events

[jjordan-quantum]

I am running ubuntu on an ec2 with only ssh allowed inbound, and when i run sshlog watch I am not seeing any connection attempts, but many connection_close events from ip addresses and high port numbers, like 30000-60000. What might be the reason for this?

[bobpaul]

I wonder if those correlate to failed login attempts. What does journalctl -u sshd show? You might also see login failed attempts via /var/log/auth.log.

[matthill]

I would bet it's hackers trying to connect to your machine. There should be a corresponding authentication_failure event though.