An utility or whatever that can monitor/log all the activities in OS of the compromised machine

[Sthu Deus <sthu.deus@gmail.com>]

Good day.

Is there an utility or whatever that can monitor/log all the activities in OS
of the compromised machine to investigate the situation?

And, what is more
important - could You share Your experience on how to illuminate from whence
the criminal got its root privileges?

Is it possible to log net activities through iptables? - I did try LOG target
but w/ no success.

Thank You for Your time.