I'm gettign mail from logwatch as to the following: root (en201247.uac63.hknet.com): 3 Time(s) What's my best plan of action to respond to such? Yes I root logins via sshd disabled. Thanks for the advice.