How to identify privilege escalation attempts in Linux logs

Question

I need to monitor Linux logs for signs of privilege escalation attempts but I’m unsure which logs to check and how to interpret them. Specifically, I want to know:

• What log files (/var/log/auth.log, /var/log/secure, etc.) record sudo and su activities?
• How to detect suspicious commands indicating privilege escalation (e.g., exploitation of SUID binaries, kernel exploits)?
• How to set up real-time monitoring or alerts for such attempts using tools like auditd or OSSEC?

A guide on detecting and responding to privilege escalation attempts would be helpful.