You could make a script that searches log files and greps for matching entries (like "sudo:" etc).
Put it in your crontab for daily execution, and send the output to a directory like ~/Public (for example).
So you could possibly find and log some unauthorized activity on your computer.
Here's an example of a script that does this. (don't hate, I made it)
It searches Logs: system messages, auth.log, deamon.log, bash history.
And outputs the results to ~/Public in the form of a txt file.
Code:
#!/bin/bash
znet=`netstat -a | grep 'LISTEN'`
zconn=`echo "$znet" | grep tcp`
zconn2=`sudo netstat -tlnp`
zombies=`ps aux | awk '{ print $8 " " $2 }' | grep -w Z`
znewfile=`date +%b-%d-%T`
zmonth=`date +%b`
zday=`date +%e`
zlog1=`cat /var/log/messages | grep "kernel:"`
zlog2=`echo "$zlog1" | grep "$zmonth $zday"`
zlog3=`cat /var/log/auth.log | grep "sudo:"`
zlog8=`cat /var/log/auth.log | grep "dbus-daemon:"`
zlog4=`echo "$zlog3" | grep "$zmonth $zday"`
zlog9=`echo "$zlog8" | grep "$zmonth $zday"`
zlog5=`cat /var/log/daemon.log | grep "init:"`
zlog7A=`cat /var/log/daemon.log | grep "started"`
zlog6=`echo "$zlog5" | grep "$zmonth $zday"`
zlog7=`echo "$zlog7A" | grep "$zmonth $zday"`
bashH=`cat ~/.bash_history`
echo "This is a daily log check: $znewfile" > ~/Public/$znewfile.txt
echo -e "Logs: Listening TCP ports, Zombies, system messages, auth.log, deamon.log, bash history: \r " >> ~/Public/$znewfile.txt
echo "LISTENING TCP PORTS" >> ~/Public/$znewfile.txt
echo "$zconn" >> ~/Public/$znewfile.txt
echo "$zconn2" >> ~/Public/$znewfile.txt
echo "ZOMBIES (there usually are none)" >> ~/Public/$znewfile.txt
echo -e "$zombies\r" >> ~/Public/$znewfile.txt
echo "MESSAGES LOG" >> ~/Public/$znewfile.txt
echo -e "$zlog2\r" >> ~/Public/$znewfile.txt
echo "AUTH.LOG" >> ~/Public/$znewfile.txt
echo "$zlog4" >> ~/Public/$znewfile.txt
echo -e "$zlog9\r" >> ~/Public/$znewfile.txt
echo "DAEMON.LOG" >> ~/Public/$znewfile.txt
echo "$zlog6" >> ~/Public/$znewfile.txt
echo -e "$zlog7\r" >> ~/Public/$znewfile.txt
echo "BASH HISTORY" >> ~/Public/$znewfile.txt
echo "$bashH" >> ~/Public/$znewfile.txt
EDIT: just figured out that date was wrong (should be +%b-%d-%T), and some other changes.
