centralized logging of various stuff: /var/log/messages, /var/log/secure, /var/log/audit, intrusion detection systems reporting abnormal network traffic, etc.

centralized logging of various stuff: /var/log/messages, /var/log/secure, /var/log/audit, intrusion detection systems reporting abnormal network traffic, etc. If there is no centralized logging/alerting, it is very hard to detect.