which log file should the security administrator check?

To detect if user sam has assumed the identity of user bob on a system, which log file should the security administrator check?

A.
/var/adm/sulog

B.
/var/log/aculog

C.
/var/adm/lastlog

D.
/var/log/authlog