I recently needed to review all SSH login attempts on a server running Ubuntu Server and used this one-liner to accomplish it. Piping grep into less just lets you stay on the keyboard instead of scrolling with the mouse.

grep sshd /var/log/auth.log | less