On my personal VPS I'm using separate encrypted partition to store version-controlled file containing list of all files (with size, last mod date, creation date

On my personal VPS I'm using separate encrypted partition to store version-controlled file containing list of all files (with size, last mod date, creation date etc.) and updating this file after system update. From that I know if my system was compromised. I keep another repository of all config files and scripts that automate building any non-standard components. So if I was hacked (I would assume the biggest risk is my web app) I would dump logs for later analysis and rebuild whole box from scratch in a matter of minutes. If there is nothing obvious in logs I then have my own utility that I use to detect anomalities in logs (behavioral analysis). I also use rkhunter (that in a sense does similar thing in terms of keeping track of files being changed) Apart from that I'm analysing logs frequently to see potential attempts.