HostSentry is a host based intrusion detection tool that operates on the principle of Login Anomaly Detection (LAD), or what I sometimes call logincross-correlation.
HostSentry will react to login/logout activity and process them with any
number of login or logout modules. These modules are written to detect a problem and report it.