In no case did my installation fail to generate the /var/log/auth file.
The auth file does not exist in this case.
I only have basic sudo or sddm-helper logs, and they don't show any
errors, only the correct closure.
My tty is still 1.
ruan seat0 2026-03-17 11:23
ruan tty1 2026-03-17 11:23
When I search for PAM in KsystemLog, I only get the following outputs.
17/03/2026 11:23 sddm-helper pam_kwallet5(sddm:auth):
pam_kwallet5: pam_sm_authenticate
17/03/2026 11:23 sddm-helper pam_kwallet5(sddm:setcred):
pam_kwallet5: pam_sm_setcred
17/03/2026 11:23 sddm-helper pam_unix(sddm:session): session
opened for user ruan(uid=1000) by ruan(uid=0)
17/03/2026 11:23 (systemd) pam_unix(systemd-user:session): session
opened for user ruan(uid=1000) by ruan(uid=0)
17/03/2026 11:23 sddm-helper pam_unix(sddm-greeter:session):
session closed for user sddm
17/03/2026 11:23 sddm-helper gkr-pam: unlocked login keyring
17/03/2026 11:23 sddm-helper pam_kwallet5(sddm:session):
pam_kwallet5: pam_sm_open_session
17/03/2026 11:23 sddm-helper pam_kwallet5: final socket path:
/run/user/1000/kwallet5.socket
17/03/2026 11:23 sddm-helper pam_env(sddm:session): deprecated
reading of user environment enabled
17/03/2026 11:23 sddm-helper [PAM] Closing session
17/03/2026 11:23 sddm-helper [PAM] Ended.
17/03/2026 11:23 systemd Started plasma-kwallet-pam.service -
Unlock kwallet from pam credentials.
17/03/2026 11:23 pam_kwallet_init 2026/03/17 11:23:21 socat[1822]
W address is opened in read-write mode but only supports read-only
17/03/2026 11:23 (sd-pam) pam_unix(systemd-user:session): session
closed for user sddm
17/03/2026 11:30 CRON pam_unix(cron:session): session opened for
user root(uid=0) by root(uid=0)
17/03/2026 11:30 CRON pam_unix(cron:session): session closed for
user root
17/03/2026 11:31 sudo pam_unix(sudo:session): session opened for
user root(uid=0) by ruan(uid=1000)
17/03/2026 11:31 sudo pam_unix(sudo:session): session closed for
user root
17/03/2026 11:31 sudo pam_unix(sudo:session): session opened for
user root(uid=0) by ruan(uid=1000)