Found the cyrus bits - all syslog at DEBUG level - e.g. http://sourcecodebrowser.com/cyrus-sasl2/2.1.19.dfsg1/auth__pam_8c_source.html#l00208  - message varies per plugin used.