Tripwire is useful for post-facto detection - at least as long as the attacker doesn't get root - but logwatch defaults to letting stuff through, which means that any change in log formatting by any program means that your "security" suddenly fails.