^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ runuser\[[[:digit:]]+\]: pam_unix\(runuser:session\): session opened for user [._[:alnum:]-]+\(uid=[0-9]+\) by [._[:alnum:]-]*\(uid=[0-9]+\)$
^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ runuser\[[[:digit:]]+\]: pam_unix\(runuser:session\): session closed for user [._[:alnum:]-]+$
