You can get notification email when some one login to your server as root when you are using bash shell.
To enable root login notification, do the following
1. cd /root
2. edit .bashrc file with command
3. Add following content to .bashrc file
echo ‘ALERT – ServerName Root Access on:’ `date` `who` | mail -s “Alert: Root Access from `who | cut -d'(‘ -f2 | cut -d’)’ -f1`” email@example.com
ServerName to your server name.
firstname.lastname@example.org to your email address.
4. Save and Exit vi text editor with command :wq
Now log out of SSH and login, you will get SSH Root Login alert email with IP addrss and time of login.