Hi ,
I have recently inherited a LINUX Network without any documentation anything at all . I would like your advise on :
1) How can I collect and check logs to see If someone was trying to break in .

Any Ideas Appreciated .
Regards
John Jacks

It sounds to me like you want to configure syslog on all your boxes to send all its messgaes to a loghost. That way anything sent through syslog will get log to the single box where you can carry out your checks. Have a look at man syslog.conf at it has some pretty good examples. You might also want to look at the various howto's available on http://www.tldp.org

HTH and welcome to LQ!

Jamie...

Jharris' advice will be an excellent way to improve your current logging situation.

a LINUX Network without any documentation

There is a problem you will need to address and that is the current unknown/untrusted state the boxen are in. If you're speaking about break in attempts in the past tense: the attempts itself aren't interesting, but those that succeeded are. If some did, then I would advise caution: chances are you probably won't find much info about them in the logs. Start logging all in/outbound traffic, determine the most crucial boxen, backup, change all passes and start your audit.