What's the best way to monitor a system for attacks?

[eraker]

A thread on firewalls in the Coffee Lounge section made me realize that I have no idea how to monitor if my online computer is being probed or attacked or whatever. I tried googling, assuming there were programs out there that did this, but I couldn't come up with much (possibly because I'm not sure the right terminology to use to look for an answer). Anyway, are there system logs that record all of this in a way I could figure out or do I need a program to monitor the system for attacks?


Thanks for your help.

[bigtomrodney]

check out /var/log , you will find most of what you need here. Just use grep to find keywords. An example of something I use woud be -

grep -ir warning *
grep -ir ssh *
grep -ir breakin

You can check for any keywords you like this way.

[eraker]

Awesome. I think I was using bad terms to search for an answer.

Thanks.

[framp]

...do I need a program to monitor the system for attacks?...

Search for snort