Tiger

Tiger is useful as an application auditing tool. It discovers open ports, unusual files (modified, unusual names, files that don't belong to any package), dormant users, and various other system configuration.

Regular cron jobs get dispatched and new items of interest are mailed to root.

Additional file checking can be done with tripwire or AIDE (enabled in /etc/tiger/tigerrc).