(If you disabled root logins login with your other username, and su to root) Type: pico .bash_profile At the end of the file put this:
echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access from `who | awk '{print $6}'`" offsite@emailaddress.com
Make sure that the e-mail address you use is not hosted on the server as a hacker could simply delete the e-mail and notifications, and you would never know.
Web Hosting Affiliate ( http://www.session9.co.uk/web-hosting-affiliate/ )