What log files can I look at to find out when passwords are getting
changed?

In particular, the root password.

thanks,
John