How to find out who changed the password in Unix or Linux

We can check it in messages file in /var/log folder

Then Edit the file in those time and line and then before you will be able to know who logged into that server at what time from which IP address.

[root@TEST log]# pwd
/var/log
[root@TEST log]# cat messages |grep password
Jan 22 11:03:37 TEST passwd(pam_unix)[800]: password changed for oracle