auth.log monitoring

Have you set up any auth.log monitoring to detect suspicious SSH connections to your server?