If SSH root login is disabled, why does auth.log keep track of all the failed attempts and thus causing the admin more data to wade through? Can I disable this behaviour? Can I redirect those failed attempts into another file, as the attempts are not really a concern anymore? Blocking the IPs via firewall would prevent them from appearing, I'm aware, but blocking IPs is silly as a long term solution as it prevents genuine requests since an IP doesn't represent a single host in many cases.
auth is the default SysLogFacility for sshd (openssh).
The authors choose to log attemts althouh prohibited. This is along normal logging behviour: If something does NOT work, log it.
As there is no specific log switch for failed root logins within sshd you have tp tune that on syslog level.
Configure syslog in the auth facility to ignore failed root login messages coming from sshd.
Attempts to log in as root on your server are an indication of an intrusion attempt. The defaults are set up in line with information security best practice, so that admins are aware when someone is trying to access their servers as root.
Ignoring failed root logons runs counter to best practice. If you do not want to see the failed root logon entries in the security log, configure syslog to send them somewhere else.