suPHP is a combination of an Apache module (mod_suphp) and an executable which provides a wrapper for PHP. With both together, it is possible to execute PHP scripts with the permissions of their owner without having to place a PHP binary in each user's cgi-bin directory. suPHP doesn't need Apache's suExec, and provides a logging function.
Swatch was originally written to actively monitor messages as they were written to a log file via the UNIX syslog utility. It has multiple methods of alarming, both visually and by triggering events. The perfect tools for a master loghost. It is known to work flawlessly on Linux (RH5), BSDI, and Solaris 2.6 (patched).
The system call tracker is a Linux kernel module and supporting user space applications which allow interception of and possibly taking action upon system calls that match user-defined criteria. It allows you to set such rules as "tell me when someone tries to open /etc/passwd" and "if user '500' tries to connect to the network, fail the system call". It can also be thought of as strace on steroids.