// from modules/pam_unix/unix_chkpwd.c 

        if (retval != PAM_SUCCESS) {
                if (!nullok || !blankpass) {
                        /* no need to log blank pass test */
#ifdef HAVE_LIBAUDIT
                        if (getuid() != 0)
                                _audit_log(AUDIT_USER_AUTH, user, PAM_AUTH_ERR);
#endif
                        helper_log_err(LOG_NOTICE, "password check failed for user (%s)", user);
                }
                return PAM_AUTH_ERR;