Enable email alert when wheel group user logs in?

Hello, I had csf plug in installed and added a wheel user "test(just example)" from WHM. I configured the server to send an email alert when the user "test" succeeds to login as a root. It works as follows. Log in to the server by user "test" first, then su - to root. I tried, however, the server sent the email alert when only root login succeeds, it is too late. I want that the server sends the alert email when a wheel user of "test" succeeds to login, then I could know that a hacker broke a user password, but they had not succeeded to log in by root yet. To enable the email alert when server login succeeds in user level, where may I configure of csf? Any advice would be appreciated. Thank you.