Cybersecurity

Hi everybody, I'm writing to know what the following event stands for. I know that the following event is about a "su to root" action but I don't have any Idea about what action could rise this message. For example If an acction performed by the root crontab, a sudo command or something like that. In theory the root password is unknown for everybody.
Event: 'su root' succeeded for root on /dev/???
And I wanted to ask for the ??? characters too, what they stands for.
Any help will be grateful.

Thanks Pedro.

Hello Pedro, can you post a sample of this syslog message, as well as your OS and version ? There are different flavors of syslog.