^[0-9]{4}-[0-9]{2}-[0-9]{2}T[ .:+0-9]+ [._[:alnum:]-]+ runuser: pam_unix\(runuser:session\): session (opened|closed) for user nobody