Linux system auditing by example

“This article focuses specifically on the practical aspects of
periodic system auditing based on real-world requirements from a
system administrator of a subnet in a large academic network. The
lessons learned by this administrator apply to everyone from
business intranets to home users who want to prevent their home
machine from becoming a zombie in the bot army. The administrator’s
system is required to undergo periodic, random system audits,
during which routine audit activities (such as showing that the
audit and system logs are regularly reviewed, and checking for user
accounts that have lapsed)”

Complete Story