After sudo su, user executing the command must be root

[komatom]

Issue here is that if you sudo su, and run some commands after that, they are logged as the initial user before the sudo su command.

for example:

user1 executing sudo su
user1 executing: ls /root

I think it must be

user1 executing sudo su
root executing: ls /root

[iskenyildiz]

i don't think it should work like that. The original user should be visible at all times.

[matthill]

I agree, I think you want the original user logged, but perhaps some additional flag that they are executing with root privileges.