The manual for pam_systemd_home states that debug messages can be enabled with debug=yes, but they don't state where to put it.
I tried adding the options to the relevant lines in pam.d/system-auth, but it seems to cause a syntax error and disabled sudo: I needed su to allow me to edit the files and revert the changes.