My CentOS/RHEL system may have been hacked, I'm not sure. But I'm playing it safe by creating a new slice from scratch.
I've installed tripwire, but I'd also like to be emailed when anyone logs in. I don't want to wait for the daily logwatch report, I want an immediate email when anyone logs in. Preferably with their ip address too.
Similar to http://serverfault.com/questions/34141/send-email-alert-on-log-file-entry but maybe someone has a technique for this specific issue.