/var/log/secure

Apr  3 21:34:32 splunk afpd: PAM pam_parse: expecting return value; [...requierd]
Apr  3 21:34:32 splunk afpd: pam_winbind(netatalk:auth): getting password (0x00000080)
Apr  3 21:34:32 splunk afpd: pam_winbind(netatalk:auth): user 'alothman' granted access
Apr  3 21:34:32 splunk afpd: pam_winbind(netatalk:account): user 'AD\kurre' OK
Apr  3 21:34:32 splunk afpd: pam_winbind(netatalk:account): user 'AD\kurre' granted access
Apr  3 21:34:32 splunk afpd: pam_unix(netatalk:session): session opened for user AD\kurre by (uid=0)