====== Root login warning ======

Edit /root/.bash_profile

  isRootLoggedIn=`who |grep root |awk '{print $1}'`
  
  if [ "$isRootLoggedIn" = "root" ]; then
  echo "ROOT logged into `hostname -s` on `date` was this expected?" |mail -s "ROOT logged in" noc@company.com
  fi