Install SEC on Debian
On Debian :
$ apt-get install sec
Create a config file: nano /root/root.conf
add this content to the file:
type=Single ptype=RegExp pattern=(^.+\d+ \d+:\d+:\d+)(.+)sshd\[\d+\]: Accepted password for root from (.+) desc=direct ssh root login on $2 from $3 @ $1 action=pipe 'direct ssh root login on $2 from $3 @ $1' /usr/bin/mail -s "Direct root login on $2 from $3" name@email.com
To start the monitoring:
sec -detach -conf=/root/root.conf -input=/var/log/auth.log