diff --git a/pam/TESTING.md b/pam/TESTING.md
index 993a378..3e9e477 100644
--- a/pam/TESTING.md
+++ b/pam/TESTING.md
@@ -47,8 +47,19 @@ for u in "../etc" "a/b" "" "." ".." "x..y"; do
 done
 ```
 
-Logs show up via `journalctl -t authforge_pending` (or wherever your
-distribution routes `pam_syslog` — typically `/var/log/auth.log`).
+The module logs via `pam_syslog` without setting its own `openlog` ident,
+so journal entries inherit the calling process's syslog identifier:
+`pamtester` here, `sudo` / `sshd` / `gdm` / `login` in production. The
+module name appears in the message body, so the always-works query is to
+grep for the literal string:
+
+```bash
+journalctl --since "10 minutes ago" --no-pager | grep authforge_pending
+```
+
+For pamtester runs specifically, `journalctl -t pamtester` works too.
+Older systems that route `pam_syslog` to `/var/log/auth.log` show the
+same lines there.
 
 ## Smoke test 4: recovery-code path (Phase 12)