Root Logins (Sco Unix)

[Del]

We have a suspicion that an unauthorized person has been logging on to one of our SCO Unix systems as root.  Is there any history in the system of root logins that would also show the origin (ip number, term id) of the login?  

What is the best way to monitor root logins in the future?

We have changed the password, but it seems to be happening anyway.

Del
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.celestial.com/pipermail/filepro-list/attachments/20070601/d337c777/attachment.html