^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ login\[[0-9]+\]: '[[:alnum:]-]+' logged in  on '/dev/tty[0-9]'$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ login\[[0-9]+\]: pam_krb5\(login:auth\): user [[:alnum:]-]+ authenticated as [[:alnum:]-]+@[.A-Z]+$
