From ef70c465b8231887bf7230fdaa77788e80419687 Mon Sep 17 00:00:00 2001 From: michael Date: Mon, 27 Apr 2026 12:57:26 -0700 Subject: [PATCH] =?UTF-8?q?docs(pam):=20correct=20journalctl=20recipe=20?= =?UTF-8?q?=E2=80=94=20tag=20is=20caller-set,=20grep=20is=20universal?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pam/TESTING.md | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/pam/TESTING.md b/pam/TESTING.md index 993a378..3e9e477 100644 --- a/pam/TESTING.md +++ b/pam/TESTING.md @@ -47,8 +47,19 @@ for u in "../etc" "a/b" "" "." ".." "x..y"; do done ``` -Logs show up via `journalctl -t authforge_pending` (or wherever your -distribution routes `pam_syslog` — typically `/var/log/auth.log`). +The module logs via `pam_syslog` without setting its own `openlog` ident, +so journal entries inherit the calling process's syslog identifier: +`pamtester` here, `sudo` / `sshd` / `gdm` / `login` in production. The +module name appears in the message body, so the always-works query is to +grep for the literal string: + +```bash +journalctl --since "10 minutes ago" --no-pager | grep authforge_pending +``` + +For pamtester runs specifically, `journalctl -t pamtester` works too. +Older systems that route `pam_syslog` to `/var/log/auth.log` show the +same lines there. ## Smoke test 4: recovery-code path (Phase 12)