As system administrator, you need to monitor system activity, being aware of all aspects of your systems, including the following:
What is the normal load?
Who has access to the system?
When do individuals access the system?
With this kind of knowledge, you can use the available tools to audit system use and monitor the activities of individual users. Monitoring is very useful when there is a suspected breach in security.