I have some garbage, debug output on my screen. It 'looks' like someone has run a specific command on my tty as there appears '[root]$SPECIFICCOMMAND, but I have been present all the time. Others have remote access to this server via a VPN and the root account.

I know the specific command, it is not listed using 'history' so is there any other way to check whether someone has logged on remotely using the root account!

Secondly, why would this command appear on the server screen, output should be attached to the remote tty right? Any ideas are welcome.

Well, I found command (w) and (last), the last one shows the time of logon IPs and duration so that is a good enough trace.

should have waited 5 minutes before posting.

top -u root

see also /var/log/messages

Usual advice is to disable root logon via ssh (you do use ssh right!).
Then enable yourself to
su -
up when you need root access.
Set all root accesses to use sudo eg
sudo su -
sudo does logging.

Thankyou for the tip
I'll read up on Sudo then

Or even better, find out what they actually need (surely they don't need every possible thing on the system as root), change root password thus disabling the use of 'su' from them and make them use 'sudo' instead, after having configured 'sudo' for each of them in such a manner that they can only run the specified, really needed commands with it (no shells, su, sudo or anything that grants them root shell..it might take some time thinking but it's worth it, really). Password of root should only be known to one person, the rest should just use sudo. Even that one person who knows root password should use sudo instead of that, and it's not a bad idea to lock root account too, to prevent misusage. Using sudo is surely sufficient; spending some time with it is less wasted time than spending some time with thinking who just executed something stupid on your system as root, if there are 100 people who knew root password and they all say they don't know about it.

EDIT: sudo's logging is a handy feature, but know that if the folks have root access, you can't save the logs on the same machine. Have the logs saved onto another machine that is not accessible for the root folks, only you. This way they can't hide their traces so easily.

Bouncer's desc was what I had in mind, only he said it more clearly.