Hello…
Where does dropbear store login events; failed, successful, etc.?
Thanks…
Check systemd-journald: journalctl -t dropbear
If rsyslog is installed, /var/log/syslog and/or /var/log/daemon.log and/or /var/log/auth.log will contain those logs as well.