Linux is good at keeping a diary. Red Hat is configured at installation to keep logs of every user login and other technical information. Examining logs is more of an art than a science, however. We don’t have any explicit techniques for determining whether your system is being attacked or has been broken into. Sorry.
Experience counts for a great deal when you’re examining logs for discrepancies. The more you keep track of your system, the more you recognize its idiosyncrasies and general behavior. Red Hat checks its general-purpose logs in the /var/log directory. Check your logs frequently.