@ex-parrot Thanks! My thinking is that it’s unlikely that someone would log into the system as root directly and I already detect a shell login no matter who logs into the system. The only thing I wouldn’t be able to catch is if something elevated to root.