I don’t think I mentioned it before, but we have two free sample chapters of the OSSEC book available online.
The first one is chapter 2: http://searchsecuritychannel.techtarget.com/tip/0,289483,sid97_gci1323740,00.html
The second one is chapter 5: http://www.syngress.com/book_catalog/sample_159749240X.pdf