Given that purpose is to "monitor root access left logged in too long" you might want to have a look at Sys:Utmp maybe.