[ericd]

Good tip on the pub/priv key auth for ssh. Also on tripwire. Thanks!

Custom logs generated by your own app for things like login attempts, etc, are definitely useful for detecting issues. I was referring more to things like apache connection logs, and other logs generated by other programs - I would imagine that there's a huge range of things to look for.

[Sanguinez]

When I say logs, I mean all sort of logs (network, system, app...). So that include auth logs, apache logs and so on.