[Q] How to find what uses root.

Hello,

I have a problem where after closing the ssh access for root I have a lot of failed login attempts. Any idea how can I find what is causing this?

[myuser@mycomputer ~ ]$ su -
Password:
Last login: Tue Sep 14 06:01:53 +03 2021 on pts/6
Last failed login: Tue Sep 14 06:03:14 +03 2021 from mycomputer on ssh:notty
There were 48 failed login attempts since the last successful login.

[myuser@mycomputer ~ ]$ su -
Password:
Last login: Tue Sep 14 06:03:16 +03 2021 on pts/4
Last failed login: Tue Sep 14 06:07:00 +03 2021 from mycomputer on ssh:notty
There were 116 failed login attempts since the last successful login.

I figured 'ps -elf|grep root', but I'm not sure if that is the only way to find out.

Appreciate your help.