Plesk failed logins...

[spaceout]

I have a server that's getting hammered by failed Plesk (9.5.4) login attempts. Where can I find the IP address of the culprit?

[Choji]

You should be able to see that on the Plesk Control Panel by going to Reports tab -> Login Failures.

You could also look at the alerts log in /var/ossec/logs/alerts/alerts.log
To list the top level alerts (level 10), I use the command:
cat /var/ossec/logs/alerts/alerts.log | grep -B3 -A3 "level 10" | less

Could that help you?

Choji