format      = {host} {msg}

[sudo]
program     = sudo
pattern     = ^\s*(?P<login>\S+) : TTY=(?P<tty>\S+) ; PWD=(?P<pwd>.+?) ; USER=(?P<user>\S+) ; (?:ENV=(?P<env>.+?) ; )?COMMAND=(?P<command>.*)

format      = {login}:{tty} - {user}@{host}:{pwd} - {command!r}

#pattern     = \s*(?P<login>\S+) : TTY=(?P<tty>\S+)\s; PWD=(?P<pwd>.+?)\s; USER=(?P<user>\S+)\s;( COMMAND=(?P<command>.*)

[puppet_readshadow]
rule        = sudo
login       = puppet
user        = root
command     = /usr/bin/getent shadow \w+
format      = 


[ssh]
program     = sshd
pattern     = \s*Accepted password for (?P<user>\S+) from (?P<ip>\S+) port (?P<port>\S+) (?P<proto>\S+)
format      = SSH login for {user}@{host} from {ip}

[cron]
program     = cron

[su_nobody]
program     = su
pattern     = Successful su for nobody by root|\+ \?\?\? root:nobody

[puppet]
program     = puppet