I just downloaded SNARE for my Red Hat 7.2 server/desktop machine. It gives you event logging/audit features similar to Windows NT with a GUI interface. Check it out at http://intersectalliance.com/projects/Snare/ Sure, I could complain about what's missing or its high CPU usage on my machine - but - then I remember how much I paid for it.