^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [[:alnum:]]+\(pam_[[:alnum:]]+\)\[[0-9]+\]: session opened for user [[:alnum:]-]+ by \(uid=0\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [[:alnum:]]+\(pam_[[:alnum:]]+\)\[[0-9]+\]: session closed for user [[:alnum:]-]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ PAM_[^[:space:]]+: [^[:space:]]+ session opened for user [[:alnum:]-]+ by \(uid=0\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ PAM_[^[:space:]]+: [^[:space:]]+ session closed for user [[:alnum:]-]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cracklib: updating dictionary [0-9]+ [0-9]+ words\.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ identd\[[0-9]+\]: started$
