If you happen to be figuring out who is loging in or what is being logged in the system you can always use this defined entry to .bashrc to help monitor it.
echo 'ALERT - Root Shell Access (ServerName) on: `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" some_domain@domain.com
But please note that you will have to have either postfix / sendmail (mail server) and mail client "mailx" installed to get this working.
