There are a number of security analysis, monitoring and logging tools. It has a set of tutorials that explain each security problem and how to rectify the problem. It is probably the most controversial security tool of all time, and not just because of the name. A lot of people honestly believe that the good guys should not have access to tools like this because the tools can be misused by attackers to gather information for breaking into computer systems. COPS COPS is an earlier security tool that is now somewhat outdated, but still may be worth using.
Local users can use .forward to exec programs.
Remove SUID bit. The lastcomm command allows you to view a history of the commands executed by a particular user. It should be noted that syslog is vulnerable to various attacks, including forgery, denial of service and flooding.