Can I tell if Root / Sudo has been used/accessed

Question

Would it be possible to check if the root user (or sudo) has been accessed on my server.

I ask this because I am creating a server monitoring tool and I wanted to know if there was a way to check this.

If it is possible where would I go to check it.

I am currently testing my application on Arch Linux and Ubuntu 11.04

Any help would be much appreciated.

Thanks!

Answer 1

Normally using grep on /var/log/auth.log should show you who/what got root privileges.