Get notified when root logs in.

edit the file /root/.bashrc and add the following lines:

echo ‘ALERT – Root Shell Access on:’ `date` `who` | mail -s “Alert: Root Access from `who | cut -d”(” -f2 | cut -d”)”
-f1`” myemail@domain.tld

save and exit, logout and login again, this will send you an email everytime a user who logs via ssh becomes root.

the email will be something like this :

ALERT – Root Shell Access on: [your date] 15:06:15 GMT-2 2007 username pts/0 Oct 12 09:00 (your_isp_hostname.tld)