Im new to the investigating a linux server to see if it is compermised. Are there any tips that yall could give me on this. Like what commands to use first and what to do when I find how the server was compermised?