^.{3} [ 0-9][0-9] [0-9]{2}:[0-9]{2}:[0-9]{2} .+ pam_tcb\[[0-9]+\]: (su|sshd|login): Session opened for [^ ]+ by .*\(uid=[0-9]+\)$
^.{3} [ 0-9][0-9] [0-9]{2}:[0-9]{2}:[0-9]{2} .+ pam_tcb\[[0-9]+\]: (su|sshd|login): Session closed for [^ ]+$
^.{3} [ 0-9][0-9] [0-9]{2}:[0-9]{2}:[0-9]{2} .+ pam_tcb\[[0-9]+\]: (sudo|login): Authentication passed for .+ from (LOGIN|.*)\(uid=0\)$
^.{3} [ 0-9][0-9] 04:[012][0-9]:[0-9]{2} .+ pam_tcb[\[[0-9]+\]]: su: Session opened for cacheman by \(uid=0\)$
^.{3} [ 0-9][0-9] 04:[012][0-9]:[0-9]{2} .+ pam_tcb[\[[0-9]+\]]: su: Session closed for cacheman$
