I'm managing a number of servers with dozens of Drupal sites, some with a single multi-site Drupal installation and others with dozens of separate Drupal installations. We're constantly running into the issue of one site having a lax registration or comment policy and getting overrun with node spam to the detriment of the entire server.
Addressing the spam isn't a problem once we can detect the issue (CAPTCHAs and user registration approval usually knock out most of the attacks) but most of these sites have inexperienced administrators who aren't savvy enough to notice these attacks underway and we only detect them several months in when the damage to performance and SEO has already been done. Better security policies would also obviously help and we usually try and address any potential security issues during the site build but we don't usually try and prevent the client from enabling comments or adding new features, etc.
Any recommendations for how to monitor multiple Drupal sites to detect an attack like this before it gets too far? I've seen a number of 'drupal watch' modules and services like Drupalmonitor.com or NewRelic but they seem more focused on module updates, etc. Possible signatures for a spam attack would probably be an excessive amount of comments or nodes over a given period, coming from the same server, excessive load on a specific table, etc.