Server will send email warning as soon as logged on. There is no way a hacker can hide the fact your server was accessed.
Edit the .bash_profile in the users directory
# pico .bash_profile (or nano .bash_profile if Pico/pine not installed)
Add: echo | mail -s “Subject: SRV00: ALERT – Root Shell Access on:’ `date` `who`” you@yourdomain.com