/var/log/auth.log with extra config in pam.d/login

auth.log

Jun 27 13:58:25 p14s systemd-logind[997]: New seat seat0.
Jun 27 13:58:25 p14s systemd-logind[997]: Watching system buttons on /dev/input/event13 (Power Button)
Jun 27 13:58:25 p14s systemd-logind[997]: Watching system buttons on /dev/input/event9 (Power Button)
Jun 27 13:58:25 p14s systemd-logind[997]: Watching system buttons on /dev/input/event10 (Lid Switch)
Jun 27 13:58:25 p14s systemd-logind[997]: Watching system buttons on /dev/input/event12 (Sleep Button)
Jun 27 13:58:25 p14s systemd-logind[997]: Watching system buttons on /dev/input/event7 (Generic ThinkPad Dock USB Audio Consumer Control)
Jun 27 13:58:25 p14s systemd-logind[997]: Watching system buttons on /dev/input/event0 (AT Translated Set 2 keyboard)
Jun 27 13:58:25 p14s systemd-logind[997]: Watching system buttons on /dev/input/event15 (ThinkPad Extra Buttons)
Jun 27 13:58:30 p14s su[1398]: (to layr) root on none
Jun 27 13:58:30 p14s su[1398]: pam_unix(su:session): session opened for user layr(uid=1000) by (uid=0)
Jun 27 13:58:30 p14s systemd: pam_unix(systemd-user:session): session opened for user layr(uid=1000) by (uid=0)
Jun 27 13:58:31 p14s su[1398]: pam_unix(su:session): session closed for user layr
Jun 27 13:58:32 p14s su[1910]: (to layr) root on none
Jun 27 13:58:32 p14s su[1910]: pam_unix(su:session): session opened for user layr(uid=1000) by (uid=0)
Jun 27 13:58:32 p14s su[1910]: pam_unix(su:session): session closed for user layr
Jun 27 13:58:32 p14s su[1997]: (to layr) root on none
Jun 27 13:58:32 p14s su[1997]: pam_unix(su:session): session opened for user layr(uid=1000) by (uid=0)
Jun 27 13:58:33 p14s su[1997]: pam_unix(su:session): session closed for user layr
Jun 27 13:58:33 p14s su[2043]: (to layr) root on none
Jun 27 13:58:33 p14s su[2043]: pam_unix(su:session): session opened for user layr(uid=1000) by (uid=0)
Jun 27 13:58:33 p14s su[2043]: pam_unix(su:session): session closed for user layr
Jun 27 13:59:06 p14s login[1199]: gkr-pam: unable to locate daemon control file
Jun 27 13:59:06 p14s login[1199]: gkr-pam: stashed password to try later in open session
Jun 27 13:59:06 p14s login[1199]: pam_unix(login:session): session opened for user layr(uid=1000) by LOGIN(uid=0)
Jun 27 13:59:06 p14s systemd-logind[997]: New session 2 of user layr.
Jun 27 13:59:06 p14s systemd: pam_unix(systemd-user:session): session opened for user layr(uid=1000) by (uid=0)
Jun 27 13:59:07 p14s login[1199]: gkr-pam: gnome-keyring-daemon started properly and unlocked keyring
Jun 27 13:59:20 p14s polkitd(authority=local): Registered Authentication Agent for unix-session:2 (system bus name :1.132 [/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Jun 27 13:59:20 p14s gnome-keyring-daemon[3279]: discover_other_daemon: 1
Jun 27 13:59:25 p14s sudo:     layr : TTY=tty1 ; PWD=/home/layr ; USER=root ; COMMAND=/usr/sbin/smartctl --scan
Jun 27 13:59:25 p14s sudo: pam_unix(sudo:session): session opened for user root(uid=0) by layr(uid=1000)
Jun 27 13:59:25 p14s sudo: pam_unix(sudo:session): session closed for user root
Jun 27 13:59:31 p14s su[4830]: (to layr) root on none
Jun 27 13:59:31 p14s su[4830]: pam_unix(su:session): session opened for user layr(uid=1000) by (uid=0)
Jun 27 13:59:32 p14s su[4830]: pam_unix(su:session): session closed for user layr
Jun 27 13:59:32 p14s su[4841]: (to layr) root on none
Jun 27 13:59:32 p14s su[4841]: pam_unix(su-l:session): session opened for user layr(uid=1000) by (uid=0)
Jun 27 13:59:32 p14s su[4841]: pam_unix(su-l:session): session closed for user layr