Get notified when a user logs in with root privileges.
1) Edit .bashrc under /root to get notified by email when someone logs in as root
2) Add the following:
echo ‘ALERT – Root Shell Access (Server Name) on:’ `date` `who` | mail -s “Alert: Root Access from `who | cut -d”(” -f2 | cut -d”)” -f1`” youremail@domain.com