^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ runuser: pam_unix\(runuser:session\): session opened for user debian-security-support\(uid=[[:digit:]]+\) by \(uid=0\)$
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ runuser: pam_unix\(runuser:session\): session closed for user debian-security-support$