Even login as AD user via UNAB was successfull one can find in /var/log/secure
...
Aug 3 11:49:09 rh73 sshd[12458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=Administrator
Aug 3 11:49:09 rh73 sshd[12458]: Accepted password for Administrator from ::1 port 47750 ssh2
Aug 3 11:49:09 rh73 sshd[12458]: pam_unix(sshd:session): session opened for user Administrator by (uid=0)
...
Similarly when the user is using sesu to switch to another user
(use in seos.ini old_sesu=no, thus pam is used here as well)
...
Aug 3 14:02:05 rh73 sesu: pam_unix(etrust-ac:auth): authentication failure; logname=Administrator uid=2000 euid=0 tty=/dev/pts/1 ruser= rhost= user=Administrator
Aug 3 14:02:05 rh73 su: pam_unix(su:session): session opened for user root by Administrator(uid=0)
...