查看服务器是否被***:

/var/log/messages

/var/log/secure