1

[sudo]

     2

program     = sudo

     3

     4

[[sudo_command]]

     5

pattern     = (?P<login>\S+) : TTY=(?P<tty>\S+) ; PWD=(?P<pwd>.+?) ; USER=(?P<user>\S+) ; (?:ENV=(?P<env>.+?) ; )?COMMAND=(?P<command>.*)

     6

format      = {login}:{tty} - {user}@{host}:{pwd} - {command!r}

     7

     8

[[[puppet_readshadow]]]

     9

login       = puppet

    10

user        = root

    11

command     = /usr/bin/getent shadow \w+

    12

    13

[[sudo_unknown]]

    14

format      = {host} {msg}

    15

    16

[ssh]

    17

program     = sshd

    18

pattern     = Accepted password for (?P<user>\S+) from (?P<ip>\S+) port (?P<port>\S+) (?P<proto>\S+)

    19

format      = SSH login for {user}@{host} from {ip}

    20

    21

[cron]

    22

program     = cron

    23

    24

[su_nobody]

    25

program     = su

    26

pattern     = Successful su for nobody by root|\+ \?\?\? root:nobody

    27

    28

[puppet]

    29

program     = puppet

    30

    31

[all]

    32

format      = {host} {msg}

    33