Ubuntu – find the log files for mounting disks

It is generally safe to delete log files. The only disadvantage associated with doing so is that you may not be able to examine the log, if you're troubleshooting some other problem later. Since new logs are automatically generated, even this disadvantage is short-lived.

Most logs are deleted automatically (after being rotated by compression and renaming, and kept a while in that archived format). If you have a log that's expanded faster than Ubuntu is deleting it, it's unlikely that you'll experience any problems from deleting it manually.

However, if you have a log file that's 22 gigs in size, something very strange is happening, and it would be worthwhile to investigate that. I recommend editing your question again to include a link to the Ubuntu Forums thread you're talking about, and also to include the full name of the 22 GB log file.

1) from the auth.log, how can I tell that the "successful su" was by me, not by hackers who may have gained my login info?

That would break the meaning of log files. How should your system know if it is a hacker, that did a succesfull su?

2) How to filter the auth.log file so that it succinctly reports which user successfully logged in, for how long, and from where?

That's what the program last is for. It parses the files /var/log/wmtp and /var/log/utmp, that contain this information. See:

user@host:~$ last
root     pts/0        1.2.3.4      Fri Apr  4 07:59   still logged in
root     pts/5        1.2.3.4      Wed Apr  2 15:58 - 17:00  (01:02)
root     pts/0        1.2.3.4      Wed Apr  2 07:39 - 16:15  (08:36)
root     pts/0        1.2.3.4      Tue Apr  1 07:39 - 16:00  (08:20)

Additionally your can parse older wtmp and utmp files with the -f option: last -f /var/log/wtmp.1.

3) Is there a log file to check what the hackers did?

See question 1). When a hacker gains access to your system it IS a successful authentication. So the system does not know that it is a hacker. All you can do is searching in /var/log/* for traces.