Maintenance: Monitoring
- Signs for a compromise
- Attacks
- Log
- Dropped and rejected packets
- Denied connections
- Rejected connection attempts
- Username and time of successful connections (bastion hosts)
- Error messages
- Do not log passwords (and failed user names as they might be passwords)