/etc/pam.d/password-auth
session required pam_tty_audit.so disable=username,username2 enable=username log_passwd
aureport --tty -ts today | tail
Great article, moving ur tentacles https://medium.com/swlh/the-power-of-doing-nothing-at-all-73eeea488b8b