disclaimer: I have no idea about Linux auditing: If you 'sudo -s' (or one of its friends) does the log still record the commands done in the "root shell"?