Keeping your applications updated is a good start to securing your servers. Running only the applications you absolutely need is also good. Such as not having your FTP running when you can SSH in to your box and bring it up before you need to transfer files.
Running http://denyhosts.sourceforge.net/ to protect against brute force SSH attacks and https://phpids.org/ to monitor for cross site scripting in your applications.
If you know enough to secure your box by simply running what you need and keeping it up to date then no scanner is really a good one. What does it matter if a scanner is checking for hundreds of remote vulnerabilities that are 10 years old?
nmap is the best scanner for the average person, simply put it'll tell you what ports are open on your server. Figure out what purpose they have if you can close some do so. Update all other services running, and Google for monitoring applications.
Reviewing your log files once in a while is good, and using multitail to monitor log files in real time in another monitor is good to see whats going on in real time. Sniffit is also a good terminal application to monitor your servers connections and view them. For xwin wireshark formerly etherreal