Ask HN: How to monitor the security of a personal VPS?

I have a personal VPS for my blog and side projects. Recently I noticed something fishy is going on on my server: some bins are gone, ssh last login IPs belongs to a docker container even if it’s me, etc. I currently have no way to confirm if my server is compromised, and if it’s, how it’s compromised. The only security measure I have is disallowing ssh login via password.

I wonder if there are books or resources on how to:

1. Monitor the security of a Linux server, e.g., successful ssh logins, files written to where shouldn’t be any writes, etc. 2. Alert when intrusion happens. 3. Some way of telling if the current server is compromised 4. If the server is compromised, a report on what the intruder actually did.

My knowledge in the server security area is pretty scant, if there are other things I should pay attention to, please let me know.