Thought I'd pop up some of the tools I or my team have had to use on a few occasions. Assuming a server is compromised (and you have your computer forensic toolkit on hand to look at that) then I'd want the following:
- grep/perl scripts (although I am slowly learning ruby)
- netflows (although looking at Argus I think it might be a better bet)
Depending on the initial assessment of the server, you might pull the power, disconnect from network, or drop into an investigative network. If I'm pulling power I then want to review from the infrastructure around the server, and the path to the Internet - looking for compromise within the network and communications through the perimeter. For the 3rd option I'd want to be monitoring live logs from my investigation network. In any case I'd want a check throughout the network for signs of compromise.
SIEM tools at this point can be very effective when enterprise wide - they can be updated as the investigation progresses, helping to limit further compromise.
But the majority of the effort will come after the fact - and most of my dealings with logs have all been down the grep route.