This is a great script to use on Linux servers that you really want to know who has been logging into them e.g. Public web servers or critical systems. It can also aid in the process of change management.
Code:
echo 'Login on' `hostname` `date` `who` | mail -s "Login on `hostname` `who | sort -k 3,4 -r | head -1 | awk '{print $5}'`" [email protected]
Place this code in your /etc/profile file on a Debian based system.
Reference: Linux Magazine
http://www.linux-magazine.com/Issues/2010/117/SPYGLASS