You need to check the logs for a problem and you know when it occurred. This will allow you to grab all of the entries for a period of time to make the search for clues easier.

sudo cat secure | awk '/^Dec  1 09:27/,/^Dec  1 09:33/'
Dec  1 09:03:09 u16532612 sshd[24297]: Failed password for root from 43.229.53.54 port 43335 ssh2
Dec  1 09:03:12 u16532612 sshd[24297]: Failed password for root from 43.229.53.54 port 43335 ssh2
Dec  1 09:03:14 u16532612 sshd[24297]: Failed password for root from 43.229.53.54 port 43335 ssh2