This script, run on a regular (daily) basis, keeps tabs on root accounts and set[ug]id root files.
You can download it from the following link: https://packetstormsecurity.com/files/download/12849/sysmon.pl
Source: https://packetstormsecurity.com/files/12849/sysmon.pl.html