This article explains the security logs which display failed login attempts from a host named ‘ttyu0’ or ‘[unknown]’ .

Error Log:

TTY is short for teletype, but it is popularly known as terminal. It is a device (implemented in software nowadays) that allows you to interact with the system by passing the data (you input) to the system, and displaying the output produced by the system.

TTYuN is the terminal corresponding to the device's serial ports, where N is the port number, starting from zero. If the terminal is connected to the first serial port, then the terminal will be TTYu0.

The ttyu0 you see in the below messages refers to the terminal on which the failed login attempt was made, not to the user who was trying to connect.

Oct 11 04:33:20.749 2019  login[75401]: LOGIN_FAILED: Login failed for user XX from host ttyu0
Oct 11 04:33:20.749 2019  login[75401]: Login attempt for user % Authentication failed from host [unknown]
Oct 11 04:31:19.776 2019  login[75381]: LOGIN_FAILED: Login failed for user password: from host ttyu0
Oct 11 04:31:19.776 2019  login[75381]: Login attempt for user % Authentication failed from host [unknown]

Host ttyu0 is referring to the serial terminal (console), not to an actual host, and [unknown] represents a general reference for a user not known by the system or the network.

On the other hand, considering the below logs:

Log Set 2:

Oct 15 14:43:55.810 2018 sshd: %AUTH-5-SSHD_LOGIN_FAILED: Login failed for user 'TEST' from host '192.168.1.1'
Oct 15 14:44:10.818 2019 sshd: %AUTH-5-SSHD_LOGIN_ATTEMPTS_THRESHOLD: Threshold for unsuccessful authentication attempts (3) reached by user 'TEST'

Here, the device detects an SSH attempt being made from user TEST and identifies the source as 192.168.1.1.

The above two log sets should have been able to establish when you are looking for the username and where you are looking for the device/port that the username is using when connecting to your device. Be careful when interpreting the logs because the terminal (interface or devices used to connect to the device) and the username used to authenticate on the device may be confused.