Tina's SANS Webcast:
Top Ten syslog Signs You Have Been Hacked

Nearly every system administrator knows how important it is to
monitor logs for hacker activities, but very few can decipher the
cryptic coding systems used in the logs, and even fewer know exactly
what they hope to find. In this authoritative web cast, Tina Bird
of Stanford University (previously with Counterpane) provides the
type of guidance that can usually be found only in SANS courses.
Tina will take you through ten specific (and common) attacks and show
you exactly what would have been recorded in the logs.
Begin download (slides in PDF format)