Periodic checks for a server machine:

* Configuration file changes in /etc.
* Changes to /etc files passwd, group and shadow.
* SSH login attempt history, especially failed ones (w, last, /var/log/auth).
* Root login attempt history, especially failed ones (/var/log/auth).
* Invalid and failed FTP login attempts.
* Suspicious attempts to access admin web-area (/var/log/apache2/...).
* Changes to open listening ports (netstat -lp).
* CPU/MEM load (free, /proc/...)
* Major changes in used space of /home (du).
* Free disk space information within acceptable limits (df).
* Permission/Ownership changes in home folders (?).
* Check for local mail with alerts.
* Check for bandwidth cap excess dangers (vnstat).