said by HELLFIRE: I don't know if it supports it, but if VNC or the machine itself permits a log of successful
logins, set it up so you can keep track of VNC attempts.
what's the point, it can be easily defeated if the attacker gets some sort of privledged access over VNC (unless you output to a line printer)