http://www.la-samhna.de/samhain/
Samhain is a multiplatform, open source host-based intrusion detection system (HIDS). Samhain provides file integrity checking, as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes.
http://www.cs.tut.fi/%7Erammer/aide/manual.html
The beginnings of the manual for AIDE (Advanced Intrusion Detection Environment), the free replacement for Tripwire.
