pam.rules does not support pam_unix2 format (SuSE)
pam_unix2 logging format is slightly different from the format used by other PAM modules.
#2 Updated by about 15 years ago
here are one for root and one for a user :
Oct 2 14:40:05 suse-9.2 sshdr18725: error: PAM: Authentication failure for root from unknown.anywhere.net
Oct 2 14:46:52 suse-9.2 sshdr18804: error: PAM: Authentication failure for foobar from unknown.anywhere.net
Hope it helped