So,

shell_history

is one great option, but it can definitely be evaded. I'd suggest maybe a combination of

shell_history

and either process auditing or as @obelisk suggested checking the processes table periodically for a

sudo

process running?