Look in the system logs for the output of getty. Add the monitoring of these messages to your log-watching procedures.