lastb reads /var/log/btmp and lists failed login attempts with usernames and source addresses, so it is the first stop when investigating break-in attempts. Reading btmp needs root, hence sudo. The output can be noisy, so pipe it through sort uniq -c to spot brute-force patterns.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.