Alright. So it's all set up, but is it working? Well, your guess is as good as mine... ;-) But you can check your log files and root account email.

In it's default configuration, /etc/syslog.conf/ is set up so that:

/var/log/auth/ reports login failures. If you mistype your passwords as often as I do, you'll have some password failures and bad usernames.

/var/log/secure/ reports connection attempts. Again, if you mistype your passwords as often as I do, you'll have some innocent Authentication failures.

/var/log/messages/ is the collection point for most system messages. You'll find login attempts, switches to your root acount, the packet filtering logs you've enabled, and oh yes, those silly spoofing attempts that are so prevalent when the students are on vacation... ;-)