If you need to get a view on authentication attemps on an ESXi and to order by IP address and attemps counts:
1grep -Eo "Connection from [^ ]* " $(ls -rt /var/log/auth.*) | awk '{print $NF}' | sort | uniq -c | sort -nr
And you will get something like:
1156 172.16.25.23 216 172.16.25.32 31 172.16.52.2
Read More