I'm currently (cold) reviewing the sulog of a Solaris box and one of my colleagues asserts that if I see a line that ends in
user1-root, therefore user1 has access to the root password.
I suspect that this could actually be the result of user1 calling
sudo su root and inputting their own password. I have no live system to test this on, so I'm wondering if someone could confirm my suspicion.
The alternative is that
sudo su root will result in a log line ending in