Watch this video on YouTube
What helps detect changes made by an intruder to the system log of a server?