What you are looking for is a simple Auth.* event .
Every Distro match the pattern in a significant log file .

Look for auth.log or secure /var/log . Or simply "grep" this pattern "COMMAND=/bin/su" in any file in var/log , to inspect where it's logged.

or put the commands in a path defined in your path section , for regular files will be ok in /usr/local/bin , this will make the command launchable simply via "boo"