When the debug option is set in the PAM configuration, redirect debug output to syslog (usually /var/log/secure).