Issue here is that if you sudo su, and run some commands after that, they are logged as the initial user before the sudo su command.
for example:
user1 executing sudo su
user1 executing: ls /root
I think it must be
user1 executing sudo su
root executing: ls /root