What is the preferred method to keep track of who is acting as root in the logs when root login is disabled (SSH) but users can run sudo -i or su - to become root?  I would like to follow every command with the original username as well.  RHEL 6 or any Linux rsyslog, etc.
Log all root activity with original username who su'd/sudoed to root
logs;root