Bug ID 1975309: Logging from PAM modules only seen for SSH authentication, and not GUI/API authentication

Last Modified: Jul 02, 2025

Affected Product(s):
F5OS Velos(all modules)

Known Affected Versions:
F5OS-A 1.5.0, F5OS-A 1.5.1, F5OS-A 1.5.2, F5OS-A 1.5.3, F5OS-A 1.8.0, F5OS-C 1.6.0, F5OS-C 1.6.1, F5OS-C 1.6.2, F5OS-C 1.8.0, F5OS-C 1.8.1

Opened: Jul 01, 2025

Severity: 3-Major

Symptoms

Logging from PAM modules (e.g. pam_unix, pam_radius_auth, or pam_unix) is only captured in system logs when a user attempts to authenticate via SSH; no such logging occurs when authenticating via the F5OS GUI or API.

Impact

PAM module log messages are not logged anywhere. The system does generate authentication success/failure messages that are captured in the audit.log, e.g.: audit-service[12]: priority="Notice" version=1.0 msgid=0x1f03000000000012 msg="User authentication failed" reason="Invalid login attempt, user-id/password is incorrect" failcount=8 user="otters".

Conditions

- F5OS system - Attempting to troubleshoot issues related to authentication

Workaround

When troubleshooting authentication issues, attempt to log in via SSH. PAM modules will generate log messages that are captured in /var/log/secure and the systemd journal.

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips