When I was running servers that had shell access, I generally had scripts that watched for suspicious things and alerted me. It trapped one user that "Never changed anything. It worked yesterday, and it doesn't work today".
I escalated his case to management, who kneecapped him into submission. You have to have good management to fall back on.
/johnny
9 posted on 08/13/2009 11:05:56 PM PDT by JRandomFreeper
(God Bless us all, each, and every one.)