^[-:T.+0-9]+ [._[:alnum:]-]+ su\[[0-9]+\]: \(pam_[[:alnum:]]+\) .*$
^[-:T.+0-9]+ [._[:alnum:]-]+ su\[[0-9]+\]: \(pam_[[:alnum:]]+\) .*$
^[-:T.+0-9]+ [._[:alnum:]-]+ su\[[0-9]+\]: .*$
^[-:T.+0-9]+ [._[:alnum:]-]+ su\[[0-9]+\]: .*$
^[-:T.+0-9]+ [._[:alnum:]-]+ su\[[0-9]+\]: \+ pts/[0-9]+ [[:alnum:]]+[-:]root$
^[-:T.+0-9]+ [._[:alnum:]-]+ su\[[0-9]+\]: \+ pts/[0-9]+ [[:alnum:]]+[-:]root$
^[-:T.+0-9]+ [._[:alnum:]-]+ su\[[0-9]+\]: \+ \?\?\? root[-:][[:alnum:]]+$
^[-:T.+0-9]+ [._[:alnum:]-]+ su\[[0-9]+\]: \+ \?\?\? root[-:][[:alnum:]]+$
