Jun 5 16:16:32-159 unix_chkpwd[14315]: check pass; user unknown
Jun 5 16:16:34-159 unix_chkpwd[14316]: check pass; user unknown
Jun 5 16:16:34-159 unix_chkpwd[14316]: password check failed for user (root)
Jun 5 16:16:34-159 su[14314]: pam_unix(su:auth): authentication failure; logname=john uid=1004 euid=1004 tty=/dev/pts/0 ruser=john rhost= user=root
Jun 5 16:16:37-159 su[14314]: pam_authenticate: Authentication failure
Jun 5 16:16:37-159 su[14314]: FAILED su for root by john
Jun 5 16:16:37-159 su[14314]: - /dev/pts/0 john:root