Can&#x27;t agree more with the OSSEC recommendation ( <a href="http:&#x2F;&#x2F;ossec.net" rel="nofollow">http:&#x2F;&#x2F;ossec.net</a> ) . Been using it extensively and gives an early warning system if something is going on (both in terms of files changes, backdoors and log trails).