I should add that I am also looking into using OSSEC.

-mi