Comprehensive guide to monitoring server security events and detecting intrusions on Linux servers. Learn how to track authentication failures, detect suspicious activity, monitor file integrity, and set up automated security monitoring with Zuzia.app.

Last updated: 2026-01-11

Server Security Events Monitoring and Intrusion Detection Guide

Server security events monitoring and intrusion detection are critical for maintaining system security and protecting against unauthorized access. This comprehensive guide covers everything you need to know about monitoring security events, detecting intrusions, tracking authentication failures, and setting up automated security monitoring on Linux servers.

For related security topics, see Server Security Audit Complete Guide. For troubleshooting authentication issues, see User Authentication Failures.

Why Security Events Monitoring Matters

Security events monitoring helps you detect unauthorized access attempts, identify security breaches, track suspicious activity, respond quickly to security incidents, and maintain compliance with security requirements. Without proper security monitoring, intrusions can go undetected for extended periods, leading to data breaches, system compromise, and compliance violations.

Effective security monitoring enables you to:

Detect intrusion attempts in real-time
Track authentication failures and suspicious login patterns
Monitor file integrity and detect unauthorized changes
Identify unusual system activity and potential threats
Maintain audit trails for compliance requirements
Respond quickly to security incidents

Understanding Security Events and Intrusion Indicators

Before diving into monitoring methods, it's important to understand key security events and intrusion indicators:

Common Security Events

Authentication Failures: Failed login attempts, invalid credentials, account lockouts
Successful Privilege Escalation: Use of sudo, su, or other privilege escalation methods
File System Changes: Unauthorized file modifications, new file creation, file deletions
Network Anomalies: Unusual network connections, port scans, suspicious traffic patterns
Process Anomalies: Unusual process execution, privilege escalation attempts, suspicious commands
System Configuration Changes: Unauthorized configuration modifications, service changes

Intrusion Indicators

Multiple failed authentication attempts from same IP
Successful logins from unusual locations or times
Unusual file access patterns or modifications
New user accounts created without authorization
Unusual network connections or data transfers
System configuration changes without documentation
Processes running with unexpected privileges

Method 1: Monitor Authentication Logs

Linux systems log authentication events in various locations:

# View failed login attempts
sudo grep "Failed password" /var/log/auth.log

# View failed SSH login attempts
sudo grep "Failed password" /var/log/auth.log | grep ssh

# Count failed login attempts per user
sudo grep "Failed password" /var/log/auth.log | awk '{print $9}' | sort | uniq -c

# View recent authentication failures
sudo tail -100 /var/log/auth.log | grep -i "fail\|denied\|invalid"

Monitor Successful Logins

# View successful logins
sudo grep "Accepted password" /var/log/auth.log

# View SSH login activity
sudo grep "Accepted" /var/log/auth.log | grep ssh

# View login activity by user
sudo lastlog

# View current logged-in users
who

Check Privilege Escalation Events

# View sudo usage
sudo grep sudo /var/log/auth.log

# View su command usage
sudo grep "su:" /var/log/auth.log

# View privilege escalation attempts
sudo grep "authentication failure" /var/log/auth.log

Method 2: Monitor File Integrity

File integrity monitoring detects unauthorized file changes:

Monitor Critical System Files

# Check file modification times
ls -la /etc/passwd /etc/shadow /etc/group

# Monitor /etc directory for changes
find /etc -type f -mtime -1 -ls

# Check for new files in critical directories
find /etc -type f -newer /tmp/reference -ls

# Monitor system binaries
find /usr/bin /usr/sbin -type f -mtime -1 -ls

Use AIDE for File Integrity Monitoring

# Install AIDE
sudo apt-get install aide

# Initialize AIDE database
sudo aideinit

# Check file integrity
sudo aide --check

# Update AIDE database after authorized changes
sudo aide --update

Method 3: Monitor System Logs for Security Events

System logs contain valuable security information:

Check System Logs

# View system log for security events
sudo journalctl -u ssh | grep -i "fail\|denied"

# View kernel messages
sudo dmesg | grep -i "error\|fail\|security"

# View recent system log entries
sudo journalctl -n 100 | grep -i "security\|auth\|fail"

# Monitor log files in real-time
sudo tail -f /var/log/syslog | grep -i "security\|auth"

Monitor Process Activity

# View running processes
ps aux

# Check for unusual processes
ps aux | grep -v "^\["

# Monitor process tree
pstree

# Check for processes running as root
ps aux | grep "^root"

Method 4: Monitor Network Activity

Network monitoring helps detect intrusion attempts:

Check Network Connections

# View active network connections
netstat -tulpn

# View network connections by process
ss -tulpn

# Check for unusual listening ports
netstat -tulpn | grep LISTEN

# Monitor network connections in real-time
watch -n 1 'netstat -tulpn'

Monitor Network Traffic

# Capture network traffic (requires tcpdump)
sudo tcpdump -i eth0 -n

# Monitor specific ports
sudo tcpdump -i eth0 port 22

# Monitor connections to specific IP
sudo tcpdump -i eth0 host 192.168.1.100

Method 5: Automated Security Monitoring with Zuzia.app

While manual security checks work for audits, production Linux servers require automated security monitoring that continuously tracks security events, detects intrusions, and alerts you when suspicious activity occurs.

How Zuzia.app Security Monitoring Works

Zuzia.app automatically monitors security events on your Linux server through scheduled command execution and log analysis. The platform:

Checks authentication logs for failed login attempts automatically
Monitors file integrity and detects unauthorized changes
Tracks system configuration changes
Sends alerts when security thresholds are exceeded
Stores all security data historically in the database
Provides AI-powered analysis (full package) to detect unusual patterns
Monitors security across multiple servers simultaneously

You'll receive notifications via email, webhook, Slack, or other configured channels when security events indicate potential intrusions, allowing you to respond quickly before systems are compromised.

Setting Up Security Monitoring in Zuzia.app

Add Scheduled Tasks for Authentication Monitoring
- Command: grep "Failed password" /var/log/auth.log | tail -20
- Frequency: Every 5-10 minutes
- Alert when: Failed login attempts exceed threshold
Configure File Integrity Monitoring
- Command: find /etc -type f -mtime -1 -ls
- Frequency: Once daily
- Alert when: Unauthorized file changes detected
Set Up System Log Monitoring
- Command: journalctl -n 50 | grep -i "security\|auth\|fail"
- Frequency: Every 15 minutes
- Alert when: Security events detected
Configure Network Activity Monitoring
- Command: netstat -tulpn | grep LISTEN
- Frequency: Every 30 minutes
- Alert when: New listening ports detected

Custom Security Monitoring Commands

Add these commands as scheduled tasks for comprehensive security monitoring:

# Check failed login attempts
grep "Failed password" /var/log/auth.log | tail -20

# Monitor file changes in /etc
find /etc -type f -mtime -1 -ls

# Check for new listening ports
netstat -tulpn | grep LISTEN

# View recent authentication events
journalctl -n 100 | grep -i "auth\|security"

# Check for unusual processes
ps aux | grep -v "^\[" | sort -k3 -rn | head -10

Best Practices for Security Events Monitoring

1. Monitor Security Events Continuously

Don't wait for incidents to occur:

Use Zuzia.app for continuous security monitoring
Set up alerts before security events become critical
Review security logs regularly (daily or weekly)
Correlate security events across multiple servers

2. Set Appropriate Alert Thresholds

Configure alerts based on your server's normal activity:

Warning: 5-10 failed login attempts per hour
Critical: 20+ failed login attempts per hour
Emergency: Successful login from unusual location or time

Adjust thresholds based on your server's security requirements and normal usage patterns.

3. Monitor Multiple Security Indicators

Don't rely on single indicators:

Combine authentication monitoring with file integrity checks
Correlate network activity with process monitoring
Review system logs alongside authentication events
Use AI analysis (full package) to identify patterns

4. Maintain Audit Trails

Keep comprehensive security logs:

Store security event data historically
Maintain audit trails for compliance
Document security incidents and responses
Review security trends over time

5. Respond Quickly to Security Events

Have response procedures ready:

Define escalation procedures for security incidents
Prepare incident response playbooks
Test security response procedures regularly
Document security incident responses

Troubleshooting Security Events

Step 1: Investigate Authentication Failures

When authentication failures occur:

Review Authentication Logs:
- Check failed login attempts in /var/log/auth.log
- Identify source IP addresses
- Determine if failures are from legitimate users or attackers
Check User Accounts:
- Verify user account status
- Check for account lockouts
- Review password policies

Step 2: Investigate File Integrity Issues

When file integrity alerts occur:

Identify Changed Files:
- Review file integrity check results
- Compare current files with known good state
- Determine if changes were authorized
Investigate Changes:
- Check file modification times
- Review system logs around change time
- Verify changes with system administrators

Step 3: Respond to Intrusion Attempts

When intrusions are detected:

Immediate Actions:
- Block source IP addresses if necessary
- Review affected systems
- Check for signs of compromise
Investigation:
- Review all security logs
- Check for unauthorized access
- Verify system integrity

FAQ: Common Questions About Security Events Monitoring

How often should I check security events on my Linux server?

For production servers, continuous automated monitoring is essential. Zuzia.app checks security events every few minutes automatically, stores historical data, and alerts you when suspicious activity is detected. Manual checks are useful for audits, but automated monitoring ensures you don't miss security incidents.

What security events should I monitor?

Monitor authentication failures, successful logins from unusual locations, file integrity changes, system configuration modifications, network anomalies, and process activity. Focus on events that indicate potential intrusions or unauthorized access.

Can Zuzia.app detect intrusions automatically?

Yes, Zuzia.app can detect intrusions by monitoring authentication failures, file integrity changes, unusual network activity, and system configuration modifications. The AI analysis (full package) can identify patterns that indicate potential intrusions.

How do I respond to security alerts?

When security alerts occur, immediately investigate the source, review affected systems, check for signs of compromise, and take appropriate action (block IPs, review logs, verify system integrity). Document all security incidents for future reference.

Should I monitor security events on all servers?

Yes, monitor security events on all production servers. Intrusions can occur on any server, and comprehensive monitoring helps detect threats across your entire infrastructure.

Related guides
Related recipes
Related problems
- User Authentication Failures
- Configuration Drift Causing Issues

Server Security Events Monitoring and Intrusion Detection Guide