# Cannot get PAM debug messages into /var/log/messages

## theosib

I'm getting an intermittent auth failure from netatalk, and I would like to troubleshoot it.  It's PAM that's denying authentication, and the regular messages I get out are uninformative:

```
Jan 27 16:46:37 compute0 afpd: pam_unix(netatalk:auth): authentication failure; logname= uid=0 euid=0 tty=afpd ruser= rhost=laura-millers-imac  user=millerti
```

To enable PAM debugging, I've done the following:

- enable the "debug" USE flag for PAM

- touch /etc/pam_debug

- restart the PAM-using process (atalk)

I can't figure out if there's anything I need to tell syslog-ng.  There are no filters, so as far as I can see, everything should come though into /var/log/messages.  Whenever I restart either atalk or syslog-ng, my terminal is briefly flooded with the sorts of PAM debug messages I'm looking for, but then that stops, and I cannot find them being logged anywhere.

What am I missing?

Thanks!

----------

## lxg

Did you have a look at /var/log/auth.log?

----------

## theosib

There is no /var/log/auth.log

----------

