The SSH logs are configured to be sent to the syslog facility AUTHPRIV. In a default SIMP install, this does not send them to an external host until one is defined.
AUTHPRIV
References: AU-4 (1)