Edit /root/.bash_profile

isRootLoggedIn=`who |grep root |awk '{print $1}'`

if [ "$isRootLoggedIn" = "root" ]; then
echo "ROOT logged into `hostname -s` on `date` was this expected?" |mail -s "ROOT logged in" noc@company.com
fi