This will allow you to be notified instantly via email whenever someone logs into your server as root.ssh into your server
su to root
or su -cd to /root
edit your .bashrc file
add the following to the end of the file
echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" firstname.lastname@example.org
Replace YourServerName with the name of your server.
Replace email@example.com with the email address you want the alerts sent to.
:x to save and exit
logout from your server, close the connection and log back in.
You will receive an email alert of the root login after a few minutes.