i believe i was hacked

i believe i was hacked

i have recently started using Ubuntu and have enabled few basic access to the system such as ssh and sftp and also a script which emails me when anyone ssh to my system. Today i got email trigger, that some from a remote ip address logged in and it was not me so i want to see how badly has my system got compromised and what mostly did they do ?
if i cant pull that information now, what can i do to setup such logging for next time ?
please feel free to suggest any solution as i am the root and the only user...