[root@srv-hyp-4:~] tail -f /var/log/auth.log

2019-12-01T05:06:27Z sshd[1141668]: /etc/ssh/sshd_config line 21: Unsupported option PrintLastLog

2019-12-01T05:06:27Z sshd[1141668]: Connection from 172.29.129.136 port 25097

2019-12-01T05:06:31Z sshd[1141670]: pam_access(sshd:auth): access denied for user `esximon' from `172.29.129.136'

2019-12-01T05:06:36Z sshd[1141670]: [module:pam_lsass]pam_sm_authenticate: failed [error code:40017]

2019-12-01T05:06:37Z sshd[1141668]: error: PAM: Permission denied for esximon from 172.29.129.136

2019-12-01T05:06:37Z sshd[1141672]: pam_tally2(sshd:auth): user esximon (1000) tally 143, deny 5

2019-12-01T05:06:37Z sshd[1141672]: pam_access(sshd:auth): access denied for user `esximon' from `172.29.129.136'

[root@srv-hyp-4:~] pam_tally2 --user esximon

Login           Failures Latest failure     From

esximon           145    12/01/19 05:08:03  172.29.129.136

Web ui: "Remote access for ESXi local user account 'esximon' has been locked for 900 seconds after 145 failed login attempts."

I didn't disable zabbix monitoring for host, but changed username that it uses to "esximontest" so there are logs: