[CentOS] Simple IPTABLES Question

I added these rules to IPTABLES to slow brute force attacks.

iptables -A INPUT -p tcp --dport 22 -s my_subnet/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent
--set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent
--update --seconds 60 --hitcount 5 --rttl --name SSH -j DROP

I would like log entries when connections are dropped to see that its
working.  How do I do that?

I am guessing I would add this before the drop.

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent
--update --seconds 60 --hitcount 5 --rttl --name SSH -j LOG
--log-prefix 'SSH attack: '

Is that right?  Thanks.

Matt