Debugging PAM issues on Solaris or illumos

First off, add:

debug_flags=0xffff

to /etc/pam_debug

Then tell the system log to use a specific file for PAM debug messages by adding this line to /etc/syslog.conf:

*.debug        /var/log/pam_log

Touch that file so it exists (syslog won't create it):

# touch /var/log/pam_log

And restart the syslog service:

# svcadm restart system-log

You're ready!

Run a command that uses PAM, like passwd(1) and check the output of /var/log/pam_log.