I managed an open source project (OSSEC) for many years and this was a common question I would hear.

I gave some hints here: http://dcid.me/notes/2013-may-12

That I hope can be useful for you.

thanks,