Syslog is not logging commands run by 'root' user in NSX manager and NSX edge nodes.
This is expected behavior.
As of now there is no option to log root user actions.
On NSX manager and edges direct SSH using 'root' user can be disabled using following command. nsx> clear ssh root-login
If SSH using 'root' user is disabled then access to root requires logging to admin and then switching to root.
This can be re-enabled using following command -nsx> set ssh root-login