@ruben - I see PAM events in audit in user_events that show what’s going on with an authentication attempt — at least over SSH. are you talking about remote logins or local? and either way, if PAM is hooked to audit, you should be seeing something — and you can look at those events in sequence to tell if a user was successful or not in authentication.