What logs do I have to check daily? I am currently moderating /var/log/secure and /var/log/message Also I got this kind of message from my CSF? What does that mean? is the user with SMPAUTH try to access my webmail? and the person with htpasswd is trying to access my CPANEL?
Varies depending on what daemons / processes are running.. I would personally install some sort of rootkit checker and such (chkrootkit) and check those logs. Basically you're looking at the 'vanilla' logs and need to see what's running / what could be interesting / useful in viewing (FTP, etc). And yes you're correct about the CSF logs.