discovering source of compromise on Linux servers