Only rarely should error information be directed to the user.
Usually, this is to be limited to
“sorry you cannot login now”
type messages. Information concerning errors in the configuration
/etc/pam.conf, or due to some system
failure encountered by the module, should be written to
syslog(3) with facility-type
With a few exceptions, the level of logging is, at the discretion of the module developer. Here is the recommended usage of different logging levels:
As a general rule, errors encountered by a module should be
logged at the LOG_ERR level. However,
information regarding an unrecognized argument, passed to a
module from an entry in the
file, is required to be logged at the
Debugging information, as activated by the
debug argument to the module in
/etc/pam.conf, should be logged
at the LOG_DEBUG level.
If a module discovers that its personal configuration file or some system file it uses for information is corrupted or somehow unusable, it should indicate this by logging messages at level, LOG_ALERT.
Shortages of system resources, such as a failure to
manipulate a file or
should be logged at level LOG_CRIT.
Authentication failures, associated with an incorrectly typed password should be logged at level, LOG_NOTICE.