get notified once root login   edit /root/.bash_profile   and add the code echo 'Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")"…