If you’re noticing your server is running abnormal or you’re receiving root login messages from IPs that do not match your location, you might want to begin with checking your server for rootkits.

cd /usr/local/src  && wget http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.3.6/rkhunter-1.3.6.tar.gz?use_mirror=cdnetworks-us-1 && tar -zxvf rkhunter-* && cd rkhunter* && sh installer.sh --layout /usr/local --install 

/usr/local/bin/rkhunter --update 
/usr/local/bin/rkhunter --checkall --createlogfile

RKHunter is not 100% but it is an excellent tool to start with.