Unified Logging and syslog/log

Hi everyone;

I'm currently running into an issue with Macs running Sierra and High Sierra. I am tasked with showing the authenticated times for a user to a manager for the past 30 days.

Before I would run :

less /var/log/system.log | egrep "PAM authentication|PAMVerifyPassword2"

 Now, system.log does not record more than 3 days(I think) and syslog has been replaced with the log command which uses Apples Unified Logging system.

I tried running:

log show --style syslog | fgrep "PAM authentication granted"

What would be the best approach to accomplish this task after Centrify writes to the log and be able to query it even after 30 days?

We are a for a paid customer with the full suite and Centrify running in licensed mode.

Thanks!