How do you handle server security/intrusion monitoring?
ams6110: A really skilled intruder won't leave any obvious clues behind if he gets in.  You are likely to encounter this only if someone is deliberately targeting your server for some reason.That said, most intrusion attempts are unsophisticated,  analogous to a person walking around a parking lot trying car doors to see if any are unlocked.Tools I've used (it's been a while so some of these may be dated) include logwatch to check for suspicious log activity,  portsentry to watch for suspicious connection activity, and tripwire to spot modified system files.