Keep in mind, that in some linux systems, logrotate is triggered by cron, and may only run once a day. You may need to boost the interval to prevent your disks from filling up in a DDoS type scenario. It may also be a good idea to, rate-limit the failed login attempts by IP block, as well as by username