-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ acpid: exiting$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ acpid: starting up with netlink and the input layer$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ acpid: [[:digit:]]+ rules loaded$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ acpid: waiting for events: event logging is off$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ acpid: exiting$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ acpid: starting up with netlink and the input layer$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ acpid: [[:digit:]]+ rules loaded$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ acpid: waiting for events: event logging is off$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ apache2\.logrotate: Reloading Apache httpd web server: apache2\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ apache2\.logrotate: Reloading Apache httpd web server: apache2\.$
type=USER_ERR msg=audit\([[:digit:]]+\.[[:digit:]]+:[[:digit:]]+\): pid=[[:digit:]]+ uid=0 auid=[[:digit:]]+ ses=[[:digit:]]+ subj==?unconfined msg='op=PAM:bad_ident grantors=\? acct="\?" exe="/usr/sbin/sshd" hostname=[[:alnum:]:.]+ addr=[[:xdigit:]:.]+ terminal=ssh res=failed'([^[:alpha:]]+UID="root" AUID="[[:alnum:]]+"( ID="[[:alnum:]]+")?)?$
type=USER_LOGIN msg=audit\([[:digit:]]+\.[[:digit:]]+:[[:digit:]]+\): pid=[[:digit:]]+ uid=0 auid=[[:digit:]]+ ses=[[:digit:]]+ subj==?unconfined msg='op=login (acct="?[[:alnum:]@_-]+"?|id=[[:digit:]]+) exe="/usr/sbin/sshd" hostname=(\?|[[:alnum:]:.]+) addr=[[:xdigit:]:.]+ terminal=[^[:space:]]+ res=(failed|success)'([^[:alpha:]]+UID="root" AUID="[[:alnum:]]+"( ID="[[:alnum:]]+")?)?$
type=USER_START msg=audit\([[:digit:]]+\.[[:digit:]]+:[[:digit:]]+\): pid=[[:digit:]]+ uid=[[:digit:]]+ auid=[[:digit:]]+ ses=[[:digit:]]+ subj==?unconfined msg='op=PAM:session_open grantors=(pam_[[:alnum:]]+,?)+ acct="[[:alnum:]@_-]+" exe="[^"]+" hostname=(\?|[[:alnum:]:.]+) addr=(\?|[[:xdigit:]:.]+) terminal=[[:alnum:]/?]+ res=success'([^[:alpha:]]+UID="[[:alnum:]]+" AUID="[[:alnum:]-]+")?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: Audit daemon rotating log files$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: backlog 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: backlog_limit 8192$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: backlog_wait_time 60000$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: backlog_wait_time_actual 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: enabled 1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: failure 1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: Init complete, auditd 3.0 listening for events \(startup state enable\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: lost 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: No plugins found, not dispatching events$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: No rules$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: pid 441$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: rate_limit 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: /sbin/augenrules: No change$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: The audit daemon is exiting\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: Audit daemon rotating log files$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: backlog 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: backlog_limit 8192$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: backlog_wait_time 60000$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: backlog_wait_time_actual 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: enabled 1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: failure 1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: Init complete, auditd 3.0 listening for events \(startup state enable\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: lost 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: No plugins found, not dispatching events$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: No rules$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: pid 441$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: rate_limit 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: /sbin/augenrules: No change$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: The audit daemon is exiting\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: Got SIGHUP, reloading\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: Interface [[:alnum:]]+.IPv4 no longer relevant for mDNS\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: (Leaving|Joining) mDNS multicast group on interface [[:alnum:]]+\.IPv4 with address [[:xdigit:]:.]+\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: New relevant interface [[:alnum:]]+.IPv4 for mDNS\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: No service file found in /etc/avahi/services\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: Registering new address record for [[:digit:].]+ on [[:alnum:]]+\.IPv4\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: Withdrawing address record for [[:xdigit:]:.]+ on [[:alnum:]]+\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: Got SIGHUP, reloading\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: Interface [[:alnum:]]+.IPv4 no longer relevant for mDNS\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: (Leaving|Joining) mDNS multicast group on interface [[:alnum:]]+\.IPv4 with address [[:xdigit:]:.]+\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: New relevant interface [[:alnum:]]+.IPv4 for mDNS\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: No service file found in /etc/avahi/services\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: Registering new address record for [[:digit:].]+ on [[:alnum:]]+\.IPv4\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ avahi-daemon\[[[:digit:]]+\]: Withdrawing address record for [[:xdigit:]:.]+ on [[:alnum:]]+\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: chronyd exiting$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: chronyd version 4\.0 starting \(\+CMDMON \+NTP \+REFCLOCK \+RTC \+PRIVDROP \+SCFILTER \+SIGND \+ASYNCDNS \+NTS \+SECHASH \+IPV6 -DEBUG\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Frequency -[[:digit:].]+ \+/- [[:digit:].]+ ppm read from /var/lib/chrony/chrony\.drift$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Loaded seccomp filter$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Selected source [[:xdigit:]:.]+( \([[:alnum:].:]+\))?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Source [[:xdigit:]:.]+ (online|offline)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Source [[:xdigit:]:.]+ replaced with [[:xdigit:]:.]+ \([[:alnum:]._-]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: System clock TAI offset set to [[:digit:]]+ seconds$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Using right/UTC timezone to obtain leap second data$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: chronyd exiting$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: chronyd version 4\.0 starting \(\+CMDMON \+NTP \+REFCLOCK \+RTC \+PRIVDROP \+SCFILTER \+SIGND \+ASYNCDNS \+NTS \+SECHASH \+IPV6 -DEBUG\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Frequency -[[:digit:].]+ \+/- [[:digit:].]+ ppm read from /var/lib/chrony/chrony\.drift$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Loaded seccomp filter$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Selected source [[:xdigit:]:.]+( \([[:alnum:].:]+\))?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Source [[:xdigit:]:.]+ (online|offline)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Source [[:xdigit:]:.]+ replaced with [[:xdigit:]:.]+ \([[:alnum:]._-]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: System clock TAI offset set to [[:digit:]]+ seconds$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Using right/UTC timezone to obtain leap second data$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ CRON\[[[:digit:]]+\]: pam_unix\(cron:session\): session opened for user redmine_hnjs\(uid=1001\) by \(uid=0\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ CRON\[[[:digit:]]+\]: pam_unix\(cron:session\): session closed for user redmine_hnjs$
-
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ CRON\[[[:digit:]]+\]: pam_unix\(cron:session\): session opened for user redmine_hnjs\(uid=1001\) by \(uid=0\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ CRON\[[[:digit:]]+\]: pam_unix\(cron:session\): session closed for user redmine_hnjs$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ cron-apt: Calculating upgrade\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ cron-apt: Get:.*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ cron-apt: The following packages? (were|was) automatically installed and (is|are) no longer required:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ cron-apt: Use 'apt autoremove' to remove (them|it)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ cron-apt: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ cron-apt: Calculating upgrade\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ cron-apt: Get:.*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ cron-apt: The following packages? (were|was) automatically installed and (is|are) no longer required:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ cron-apt: Use 'apt autoremove' to remove (them|it)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ cron-apt: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: DHCPREQUEST for [[:xdigit:]:.]+ on [[:alnum:].]+ to [[:xdigit:]:.]+ port 67$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: PRC: Renewing lease on [[:alnum:]]+\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: XMT: Renew on [[:alnum:]]+, interval [[:digit:]]+ms\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: RCV: Reply message on [[:alnum:]]+ from [[:xdigit:]:]+\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: DHCPREQUEST for [[:xdigit:]:.]+ on [[:alnum:].]+ to [[:xdigit:]:.]+ port 67$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: PRC: Renewing lease on [[:alnum:]]+\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: XMT: Renew on [[:alnum:]]+, interval [[:digit:]]+ms\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhclient\[[[:digit:]]+\]: RCV: Reply message on [[:alnum:]]+ from [[:xdigit:]:]+\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: acknowledged [[:digit:].]+ from [[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding address [[:xdigit:]:]+/[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding default route via [[:digit:].]+ metric 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding IP address [[:digit:].]+/[[:digit:]]{1,2}$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding route to [[:digit:].]+/[[:digit:]]{1,2} metric 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: leased [[:digit:].]+ for [[:digit:]]+ seconds$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: removing interface$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: removing route to [[:digit:].]+/[[:digit:]]{1,2} metric 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: renew in [[:digit:]]+, rebind in [[:digit:]]+, expire in [[:digit:]]+ seconds$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: renewing lease of [[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: REPLY6 received from [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: dhcpcd exited$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: received SIGTERM, stopping$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd.sh: interface [[:alnum:]]+ has been configured with old IP=[[:digit:].]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: acknowledged [[:digit:].]+ from [[:digit:].]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding address [[:xdigit:]:]+/[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding default route via [[:digit:].]+ metric 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding IP address [[:digit:].]+/[[:digit:]]{1,2}$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding route to [[:digit:].]+/[[:digit:]]{1,2} metric 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: leased [[:digit:].]+ for [[:digit:]]+ seconds$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: removing interface$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: removing route to [[:digit:].]+/[[:digit:]]{1,2} metric 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: renew in [[:digit:]]+, rebind in [[:digit:]]+, expire in [[:digit:]]+ seconds$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: renewing lease of [[:digit:].]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: REPLY6 received from [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: dhcpcd exited$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: received SIGTERM, stopping$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dhcpcd.sh: interface [[:alnum:]]+ has been configured with old IP=[[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPADVERTISE\([[:alnum:]-]+\) [[:xdigit:]:]+ [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPCONFIRM\([[:alnum:]-]+\) [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCP, IP range [[:digit:].]+ -- [[:digit:].]+, lease time 1h$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPRENEW\([[:alnum:]-]+\) [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPREPLY\([[:alnum:]-]+\) [[:xdigit:]:]+ [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCP, sockets bound exclusively to interface [[:alnum:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPSOLICIT\([[:alnum:]-]+\) [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: RTR-ADVERT\([[:alnum:]-]+\) [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: RTR-SOLICIT\([[:alnum:]-]+\) [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq\[[[:digit:]]+\]: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset auth cryptohash DNSSEC loop-detect inotify dumpfile$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq\[[[:digit:]]+\]: started, version 2\.85 cachesize 150$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq\[[[:digit:]]+\]: using nameserver [[:xdigit:].:]+#53$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPADVERTISE\([[:alnum:]-]+\) [[:xdigit:]:]+ [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPCONFIRM\([[:alnum:]-]+\) [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCP, IP range [[:digit:].]+ -- [[:digit:].]+, lease time 1h$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPRENEW\([[:alnum:]-]+\) [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPREPLY\([[:alnum:]-]+\) [[:xdigit:]:]+ [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCP, sockets bound exclusively to interface [[:alnum:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPSOLICIT\([[:alnum:]-]+\) [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: RTR-ADVERT\([[:alnum:]-]+\) [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: RTR-SOLICIT\([[:alnum:]-]+\) [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq\[[[:digit:]]+\]: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset auth cryptohash DNSSEC loop-detect inotify dumpfile$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq\[[[:digit:]]+\]: started, version 2\.85 cachesize 150$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dnsmasq\[[[:digit:]]+\]: using nameserver [[:xdigit:].:]+#53$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auth: pam_unix\(dovecot:[[:alnum:]]+\): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=([-_.@[:alnum:]]+)? rhost=([.:[:xdigit:]]+)?( user=[-_.@[:alnum:]]+)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ auth: pam_unix\(dovecot:[[:alnum:]]+\): check pass; user unknown$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: auth-worker\([-_.[:alnum:]]+\): pam\([[:alnum:]]+,[[:digit:].]+\): unknown user$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Connection closed(: read\(size=[[:digit:]]+\) failed: Connection reset by peer)? \([[:alpha:] ]+ finished [[:digit:].]+ secs ago\) in=[[:digit:]]+ out=[[:digit:]]+( deleted=[[:digit:]]+ expunged=[[:digit:]]+ trashed=[[:digit:]]+ hdr_count=[[:digit:]]+ hdr_bytes=[[:digit:]]+ body_count=[[:digit:]]+ body_bytes=[[:digit:]]+)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Connection closed(: Connection reset by peer)?( bytes=[[:digit:]]+/[[:digit:]]+| in=[[:digit:]]+ out=[[:digit:]]+)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Connection closed \(No commands sent\) in=[[:digit:]]+ out=[[:digit:]]+( deleted=[[:digit:]]+ expunged=[[:digit:]]+ trashed=[[:digit:]]+ hdr_count=[[:digit:]]+ hdr_bytes=[[:digit:]]+ body_count=[[:digit:]]+ body_bytes=[[:digit:]]+)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Connection closed(: read\(size=[[:digit:]]+\) failed: Connection reset by peer)? \((UID FETCH|IDLE) running for [[:digit:].]+ \+ waiting input for [[:digit:].]+ secs,( [[:digit:].]+ in locks,)? [[:digit:]]+ B in \+ [[:digit:]]+(\+[[:digit:]]+)? B out, state=wait-input\) in=[[:digit:]]+ out=[[:digit:]]+( deleted=[[:digit:]]+ expunged=[[:digit:]]+ trashed=[[:digit:]]+ hdr_count=[[:digit:]]+ hdr_bytes=[[:digit:]]+ body_count=[[:digit:]]+ body_bytes=[[:digit:]]+)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Disconnected(: Logged out| for inactivity|: Disconnected| in [[:upper:]]+|: Too many invalid IMAP commands\.)?( in IDLE)? in=[[:digit:]]+ out=[[:digit:]]+( deleted=[[:digit:]]+ expunged=[[:digit:]]+ trashed=[[:digit:]]+ hdr_count=[[:digit:]]+ hdr_bytes=[[:digit:]]+ body_count=[[:digit:]]+ body_bytes=[[:digit:]]+)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Logged out in=[[:digit:]]+ out=[[:digit:]]+( deleted=[[:digit:]]+ expunged=[[:digit:]]+ trashed=[[:digit:]]+ hdr_count=[[:digit:]]+ hdr_bytes=[[:digit:]]+ body_count=[[:digit:]]+ body_bytes=[[:digit:]]+)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: lda\([[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: msgid=([[:alnum:]":<>{}@?=+/.,_!&\$%#~-]+( \(added by.*postmaster@[[:alnum:].-]+\))?|unspecified): saved mail to [[:alnum:]/._-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: lda\([[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: sieve: msgid=(\? )?([[:alnum:]":<>{}@?=+/.,_!&\$%#~-]+( \(added by.*postmaster@[[:alnum:].-]+\))?|unspecified):( fileinto action:)? stored mail into mailbox '[^[:space:]]+'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: lda\([[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: sieve: msgid=<[[:alnum:]":<>{}@=+/.,_!&\$%#~-]+>: forwarded to <[[:alnum:]":@=\+\/.,_!&\$%#~-]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(aborted authentication\): method=PLAIN, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, (TLS|SSL)(( handshaking)?(: Disconnected)?)?(, session=<[[:alnum:]/+]+>)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(aborted authentication\): method=PLAIN, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, (TLS|SSL)(: SSL_read\(\) syscall failed: Connection reset by peer)?(, session=<[[:alnum:]/+]+>)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(disconnected before greeting, waited 0 secs\): user=<>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(disconnected before greeting, waited 0 secs\): user=<>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, (TLS|SSL)( handshaking)?(:)? SSL_(accept|read)\(\) syscall failed: Connection reset by peer(, session=<[[:alnum:]/+]+>)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, method=(PLAIN|LOGIN), rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, (TLS, )?session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]+>, method=(PLAIN|LOGIN), rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS: (Connection closed|Disconnected), session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]+>, method=(PLAIN|LOGIN), rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS: (Disconnected)? SSL_read\(\) syscall failed: Connection reset by peer, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, method=(PLAIN|LOGIN), rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS: read\(size=[[:digit:]]+\) failed: Connection reset by peer, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, (TLS, )?session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? (Connection closed|Disconnected), session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? read\(size=[[:digit:]]+\) failed: Connection reset by peer, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1407609C:SSL routines:SSL(2)?3_GET_CLIENT_HELLO:http request, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:140760FC:SSL routines:SSL(2)?3_GET_CLIENT_HELLO:unknown protocol, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14076102:SSL routines:SSL(2)?3_GET_CLIENT_HELLO:unsupported protocol, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408A0C1:SSL routines:SSL(2)?3_GET_CLIENT_HELLO:no shared cipher, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408A10B:SSL routines:SSL(2)?3_GET_CLIENT_HELLO:wrong version number, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408F09B:SSL routines:ssl(2)?3_get_record:https proxy request, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408F09C:SSL routines:ssl(2)?3_get_record:http request, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408F0C6:SSL routines:ssl(2)?3_get_record:packet length too long, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408F10B:SSL routines:ssl(2)?3_get_record:wrong version number, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408F119:SSL routines:ssl(2)?3_get_record:decryption failed or bad record mac, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:140940F5:SSL routines:ssl(2)?3_read_bytes:unexpected record, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:140943F2:SSL routines:SSL(2)?3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:140943F2:SSL routines:SSL(2)?3_READ_BYTES:sslv3 alert unexpected message: SSL alert number 10, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094412:SSL routines:ssl(2)?3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094412:SSL routines:SSL(2)?3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094416:SSL routines:ssl(2)?3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094416:SSL routines:SSL(2)?3_READ_BYTES:sslv3 alert certificate unknown: SSL alert number 46, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094418:SSL routines:ssl(2)?3_read_bytes:tlsv1 alert internal error: SSL alert number 80, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094418:SSL routines:ssl(2)?3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094418:SSL routines:SSL(2)?3_READ_BYTES:tlsv1 alert unknown ca: SSL alert number 48, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1409442E:SSL routines:ssl(2)?3_read_bytes:tlsv1 alert protocol version: SSL alert number 70, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:140A1175:SSL routines:ssl_bytes_to_cipher_list:inappropriate fallback, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1417D0FC:SSL routines:tls_process_client_hello:unknown protocol, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1417D18C:SSL routines:tls_process_client_hello:version too low, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:141A20F4:SSL routines:ossl_statem_server_read_transition:unexpected message, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? syscall failed: (Broken pipe|Connection reset by peer|Success)(, session=<[[:alnum:]/+]+>)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(tried to use disallowed plaintext auth\): user=<>, rip=[.[:xdigit:]]+, lip=[.[:xdigit:]]+, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Too many (invalid|bad) commands\.?)? \(no auth attempts( in [[:digit:]]+ secs)?\): user=<>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+,( TLS,)? session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected(: Inactivity during authentication)? \(client didn't finish SASL auth, waited [[:digit:]]+ secs\): user=<[^>]*>, method=PLAIN, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?: (Connection closed|Disconnected|SSL_read\(\) syscall failed: Connection reset by peer), session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected(: Inactivity during authentication)? \(client didn't finish SASL auth, waited [[:digit:]]+ secs\): user=<[^>]*>, method=PLAIN, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS, session=<[[:alnum:]/+]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected (tried to use unsupported auth mechanism): user=<[-_.@[:alnum:]]*>, method=[[:alnum:]-]+, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+(,( mpid=[[:digit:]]+,)? (TLS( handshake)?|secured))?(: Disconnected)?(, session=<[[:alnum:]/+]+>)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Login: user=<[-_.@[:alnum:]]+>, method=[[:alnum:]-]+, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+(,( mpid=[[:digit:]]+,)? (TLS( handshake)?|secured))?(: read\(size=[[:digit:]]+\) failed: Connection reset by peer)?(, session=<[[:alnum:]/+]+>)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auth: pam_unix\(dovecot:[[:alnum:]]+\): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=([-_.@[:alnum:]]+)? rhost=([.:[:xdigit:]]+)?( user=[-_.@[:alnum:]]+)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ auth: pam_unix\(dovecot:[[:alnum:]]+\): check pass; user unknown$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: auth-worker\([-_.[:alnum:]]+\): pam\([[:alnum:]]+,[[:digit:].]+\): unknown user$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Connection closed(: read\(size=[[:digit:]]+\) failed: Connection reset by peer)? \([[:alpha:] ]+ finished [[:digit:].]+ secs ago\) in=[[:digit:]]+ out=[[:digit:]]+( deleted=[[:digit:]]+ expunged=[[:digit:]]+ trashed=[[:digit:]]+ hdr_count=[[:digit:]]+ hdr_bytes=[[:digit:]]+ body_count=[[:digit:]]+ body_bytes=[[:digit:]]+)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Connection closed(: Connection reset by peer)?( bytes=[[:digit:]]+/[[:digit:]]+| in=[[:digit:]]+ out=[[:digit:]]+)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Connection closed \(No commands sent\) in=[[:digit:]]+ out=[[:digit:]]+( deleted=[[:digit:]]+ expunged=[[:digit:]]+ trashed=[[:digit:]]+ hdr_count=[[:digit:]]+ hdr_bytes=[[:digit:]]+ body_count=[[:digit:]]+ body_bytes=[[:digit:]]+)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Connection closed(: read\(size=[[:digit:]]+\) failed: Connection reset by peer)? \((UID FETCH|IDLE) running for [[:digit:].]+ \+ waiting input for [[:digit:].]+ secs,( [[:digit:].]+ in locks,)? [[:digit:]]+ B in \+ [[:digit:]]+(\+[[:digit:]]+)? B out, state=wait-input\) in=[[:digit:]]+ out=[[:digit:]]+( deleted=[[:digit:]]+ expunged=[[:digit:]]+ trashed=[[:digit:]]+ hdr_count=[[:digit:]]+ hdr_bytes=[[:digit:]]+ body_count=[[:digit:]]+ body_bytes=[[:digit:]]+)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Disconnected(: Logged out| for inactivity|: Disconnected| in [[:upper:]]+|: Too many invalid IMAP commands\.)?( in IDLE)? in=[[:digit:]]+ out=[[:digit:]]+( deleted=[[:digit:]]+ expunged=[[:digit:]]+ trashed=[[:digit:]]+ hdr_count=[[:digit:]]+ hdr_bytes=[[:digit:]]+ body_count=[[:digit:]]+ body_bytes=[[:digit:]]+)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: imap\([-_.@[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: Logged out in=[[:digit:]]+ out=[[:digit:]]+( deleted=[[:digit:]]+ expunged=[[:digit:]]+ trashed=[[:digit:]]+ hdr_count=[[:digit:]]+ hdr_bytes=[[:digit:]]+ body_count=[[:digit:]]+ body_bytes=[[:digit:]]+)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: lda\([[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: msgid=([[:alnum:]":<>{}@?=+/.,_!&\$%#~-]+( \(added by.*postmaster@[[:alnum:].-]+\))?|unspecified): saved mail to [[:alnum:]/._-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: lda\([[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: sieve: msgid=(\? )?([[:alnum:]":<>{}@?=+/.,_!&\$%#~-]+( \(added by.*postmaster@[[:alnum:].-]+\))?|unspecified):( fileinto action:)? stored mail into mailbox '[^[:space:]]+'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: lda\([[:alnum:]]+\)(<[[:digit:]]+><[[:alnum:]+/]+>)?: sieve: msgid=<[[:alnum:]":<>{}@=+/.,_!&\$%#~-]+>: forwarded to <[[:alnum:]":@=\+\/.,_!&\$%#~-]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(aborted authentication\): method=PLAIN, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, (TLS|SSL)(( handshaking)?(: Disconnected)?)?(, session=<[[:alnum:]/+]+>)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(aborted authentication\): method=PLAIN, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, (TLS|SSL)(: SSL_read\(\) syscall failed: Connection reset by peer)?(, session=<[[:alnum:]/+]+>)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(disconnected before greeting, waited 0 secs\): user=<>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(disconnected before greeting, waited 0 secs\): user=<>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, (TLS|SSL)( handshaking)?(:)? SSL_(accept|read)\(\) syscall failed: Connection reset by peer(, session=<[[:alnum:]/+]+>)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, method=(PLAIN|LOGIN), rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, (TLS, )?session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]+>, method=(PLAIN|LOGIN), rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS: (Connection closed|Disconnected), session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]+>, method=(PLAIN|LOGIN), rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS: (Disconnected)? SSL_read\(\) syscall failed: Connection reset by peer, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, method=(PLAIN|LOGIN), rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS: read\(size=[[:digit:]]+\) failed: Connection reset by peer, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, (TLS, )?session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? (Connection closed|Disconnected), session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? read\(size=[[:digit:]]+\) failed: Connection reset by peer, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1407609C:SSL routines:SSL(2)?3_GET_CLIENT_HELLO:http request, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:140760FC:SSL routines:SSL(2)?3_GET_CLIENT_HELLO:unknown protocol, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14076102:SSL routines:SSL(2)?3_GET_CLIENT_HELLO:unsupported protocol, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408A0C1:SSL routines:SSL(2)?3_GET_CLIENT_HELLO:no shared cipher, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408A10B:SSL routines:SSL(2)?3_GET_CLIENT_HELLO:wrong version number, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408F09B:SSL routines:ssl(2)?3_get_record:https proxy request, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408F09C:SSL routines:ssl(2)?3_get_record:http request, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408F0C6:SSL routines:ssl(2)?3_get_record:packet length too long, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408F10B:SSL routines:ssl(2)?3_get_record:wrong version number, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1408F119:SSL routines:ssl(2)?3_get_record:decryption failed or bad record mac, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:140940F5:SSL routines:ssl(2)?3_read_bytes:unexpected record, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:140943F2:SSL routines:SSL(2)?3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:140943F2:SSL routines:SSL(2)?3_READ_BYTES:sslv3 alert unexpected message: SSL alert number 10, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094412:SSL routines:ssl(2)?3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094412:SSL routines:SSL(2)?3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094416:SSL routines:ssl(2)?3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094416:SSL routines:SSL(2)?3_READ_BYTES:sslv3 alert certificate unknown: SSL alert number 46, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094418:SSL routines:ssl(2)?3_read_bytes:tlsv1 alert internal error: SSL alert number 80, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094418:SSL routines:ssl(2)?3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14094418:SSL routines:SSL(2)?3_READ_BYTES:tlsv1 alert unknown ca: SSL alert number 48, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1409442E:SSL routines:ssl(2)?3_read_bytes:tlsv1 alert protocol version: SSL alert number 70, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:140A1175:SSL routines:ssl_bytes_to_cipher_list:inappropriate fallback, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1417D0FC:SSL routines:tls_process_client_hello:unknown protocol, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1417D18C:SSL routines:tls_process_client_hello:version too low, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:141A20F4:SSL routines:ossl_statem_server_read_transition:unexpected message, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(((no auth( attempts in [[:digit:]]+ secs)?|auth failed, [[:digit:]]+) attempts in [[:digit:]]+ secs|client didn't finish SASL auth, waited 0 secs|disconnected before auth was ready, waited [[:digit:]] secs)?\): user=<[[:alnum:]@_.-]*>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?(:)? SSL_(accept|read)\(?\)? syscall failed: (Broken pipe|Connection reset by peer|Success)(, session=<[[:alnum:]/+]+>)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Inactivity)? \(tried to use disallowed plaintext auth\): user=<>, rip=[.[:xdigit:]]+, lip=[.[:xdigit:]]+, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: (Disconnected|Aborted login)(: Too many (invalid|bad) commands\.?)? \(no auth attempts( in [[:digit:]]+ secs)?\): user=<>, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+,( TLS,)? session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected(: Inactivity during authentication)? \(client didn't finish SASL auth, waited [[:digit:]]+ secs\): user=<[^>]*>, method=PLAIN, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS( handshaking)?: (Connection closed|Disconnected|SSL_read\(\) syscall failed: Connection reset by peer), session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected(: Inactivity during authentication)? \(client didn't finish SASL auth, waited [[:digit:]]+ secs\): user=<[^>]*>, method=PLAIN, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+, TLS, session=<[[:alnum:]/+]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Disconnected (tried to use unsupported auth mechanism): user=<[-_.@[:alnum:]]*>, method=[[:alnum:]-]+, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+(,( mpid=[[:digit:]]+,)? (TLS( handshake)?|secured))?(: Disconnected)?(, session=<[[:alnum:]/+]+>)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dovecot: (pop3|imap|managesieve)-login: Login: user=<[-_.@[:alnum:]]+>, method=[[:alnum:]-]+, rip=[.:[:xdigit:]]+, lip=[.:[:xdigit:]]+(,( mpid=[[:digit:]]+,)? (TLS( handshake)?|secured))?(: read\(size=[[:digit:]]+\) failed: Connection reset by peer)?(, session=<[[:alnum:]/+]+>)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Accepted MAIL FROM.*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Accepted RCPT TO [^[:space:]]+$
-#^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antiabuse_Scoring: rejected AUTH for [[:xdigit:].:]+ on port [[:digit:]]+ due to DNSBL IP score: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Blacklists: domain [[:alnum:].-]+ is blacklisted at .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Blacklists: IP [[:xdigit:].:]+ is blacklisted at .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Check: reverse DNS host lookup failed$
-#^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Rejecting message from [^[:space:]]+ to [^[:space:]]+ via [[:xdigit:].:]+ due to DNSBL IP score: [[:digit:]]+$
-#^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Rejecting message from [^[:space:]]+ to [^[:space:]]+ via [[:xdigit:].:]+ due to rspamd score: [[:digit:].]+$
-#^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Rejecting message from [^[:space:]]+ to [^[:space:]]+ via [[:xdigit:].:]+ due to spamassassin score: [[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Summarized score is -?[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit: NOT delaying connection due to host [[:xdigit:].:]+ being on a whitelist$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit: NOT delaying connection due to sender being authenticated$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after AUTH for [[:digit:]]+s due to inconsistent setup score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after AUTH for [[:digit:]]+s due to IP DNSBL score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after connect for [[:digit:]]+s due to inconsistent setup score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after connect for [[:digit:]]+s due to IP DNSBL score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for [[:digit:]]+s due to domain DNSBL score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for [[:digit:]]+s due to inconsistent setup score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for [[:digit:]]+s due to IP DNSBL score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for -?[[:digit:]]+s due to rspamd score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for -?[[:digit:]]+s due to spamassassin score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after HELO [^[:space:]]+ for [[:digit:]]+s due to inconsistent setup score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after HELO [^[:space:]]+ for [[:digit:]]+s due to IP DNSBL score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after MAIL FROM [^[:space:]]* for [[:digit:]]+s due to domain DNSBL score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after MAIL FROM [^[:space:]]* for [[:digit:]]+s due to inconsistent setup score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after MAIL FROM [^[:space:]]* for [[:digit:]]+s due to IP DNSBL score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after RCPT TO [^[:space:]]* for [[:digit:]]+s due to domain DNSBL score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after RCPT TO [^[:space:]]* for [[:digit:]]+s due to inconsistent setup score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after RCPT TO [^[:space:]]* for [[:digit:]]+s due to IP DNSBL score$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Whitelists: domain [[:alnum:].-]+ is whitelisted at .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Whitelists: IP [[:xdigit:].:]+ is whitelisted at .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? AUTH allowed for [[:xdigit:].:]+ on port [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? AUTH requested from [[:xdigit:].:]+ on port (587|465)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Completed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: bad-commands
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: command-timeout$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: connection-lost$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: tls-failed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? DKIM: d=[^[:space:]]+ s=[^[:space:]]+ \[failed key import\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? DKIM: validation error: Public key signature verification has failed\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected after DATA: header syntax \(missing or malformed local part: failing address in "(From:|To:)" header is: .*\): missing or malformed local part: failing address in "(From:|To:)" header is: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected after DATA: header syntax \(unqualified address not permitted: failing address in "(From:|To:)" header is: .*\): unqualified address not permitted: failing address in "(From:|To:)" header is: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected after DATA: Rejected due to site policy reasons\. Contact postmaster in case of problems\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\](:[[:digit:]]+)? TLS error on connection \(recv\): Error in the pull function\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\](:[[:digit:]]+)? TLS error on connection \(recv\): The TLS connection was non-properly terminated\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? PRDR R=<[^[:space:]]+> acceptance$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Running acl_[^[:space:]]+ for (IP [[:xdigit:].:]+|domain [[:alnum:].-]+|user [[:alnum:]-]+)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? SMTP connection lost after final dot H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\] I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtps$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? SMTP connection lost after final dot [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: tls-failed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtpsa X=[^[:space:]]+ CV=(no|yes)( SNI=[^[:space:]]+)? A=(dovecot_plain|dovecot_login):[[:alnum:]:@.]+( PRDR)? S=[[:digit:]]+ id=[^[:space:]]+ from <[^[:space:]]+> for .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtp S=[[:digit:]]+( DKIM=[^[:space:]]+)? id=[^[:space:]]+ from <[^[:space:]]+> for [^[:space:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtps X=[^[:space:]]+ CV=(no|yes)( SNI=[^[:space:]]+)? S=[[:digit:]]+( DKIM=[^[:space:]]+)? id=[^[:space:]]+ from <[^[:space:]]+> for [^[:space:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? == [^[:space:]]+ routing defer \(-52\): retry time not reached$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? == [^[:space:]]+ R=[^[:space:]]+ T=[^[:space:]]+ defer \(-53\): retry time not yet reached$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? => [^[:space:]]+( <[^[:space:]]+>)? F=<[^[:space:]]+> P=<[^[:space:]]+> R=dnslookup T=remote_smtp H=[[:alnum:].-]+ \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( TFO)? X=[^[:space:]]+ CV=(no|yes) DN="[^"]+"( K)? C="[^"]+"$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? => [^[:space:]]+( <[^[:space:]]+>)? F=<[^[:space:]]+> P=<[^[:space:]]+> R=local_user T=deliver_pipe$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ U=[[:alnum:]]+ P=local S=[[:digit:]]+( id=[^[:space:]]+)? from <[^[:space:]]+> for .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? TLS error on connection from( [^[:space:]]+| \([^[:space:]]+\)| [^[:space:]]+ \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): The TLS connection was non-properly terminated\.(: syscall: Connection reset by peer)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-domain-score: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-inconsistency-score: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-ip-score: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_bar: [/+-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_report: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_score: -?[[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_score_int: -?[[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_bar: [/+-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_report: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_score: -?[[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_score_int: -?[[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? Connection from \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ refused: too many connections from that IP address$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? (dovecot_login|dovecot_plain) authenticator failed for ([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+: 535 Incorrect authentication data( \(set_id=[[:alnum:]_@.-]+\))?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? End queue run: pid=[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? exim [[:digit:].]+ daemon started: pid=[[:digit:].]+, -q30m, listening for SMTP on port 25 \(IPv6 and IPv4\) port 587 \(IPv6 and IPv4\) and for SMTPS on port 465 \(IPv6 and IPv4\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ incomplete transaction \(connection lost\) from <[^[:space:]]+>( for .*)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ incomplete transaction \(QUIT\) from <[^[:space:]]+>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ incomplete transaction \(RSET\) from <[^[:space:]]+>( for [^[:space:]]+)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify defer for <[^[:space:]]+>: host lookup did not complete$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify defer for <[^[:space:]]+>: remote host address is the local host$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify fail for <[^[:space:]]+>: all relevant MX records point to non-existent hosts$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify fail for <[^[:space:]]+>: host lookup did not complete$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify fail for <[^[:space:]]+>: Unrouteable address$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-])? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Rejected due to site policy reasons\. Contact postmaster in case of problems\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Rejected for too many bad recipients$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: relay not permitted$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Sender verify failed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: SPF check failed\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Unrouteable address$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> temporarily rejected RCPT <[^[:space:]]+>: Could not complete sender verify$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? rejected AUTH (LOGIN|PLAIN): Rejected AUTH due to site policy reasons\. Disable SMTP AUTH and contact postmaster in case of problems\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=\[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ Warning: ACL "warn" statement skipped: condition test deferred: host lookup deferred for reverse lookup check$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? no host name found for IP address [[:xdigit:].:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? no MAIL in SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( D=([[:digit:]]+[ms])+)?( X=[^[:space:]]+ CV=no)?( SNI=[^[:space:]]+)?( C=(HELO|EHLO|STARTTLS|AUTH|QUIT|RSET|HELP|,)+)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? rejected (EHLO|HELO) from( [^[:space:]]+)? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+: syntactically invalid argument\(s\): \(no argument given\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? REJECT \[[[:xdigit:].:]+\]: bad recipient count high \[[[:digit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? remote host address is the local host: [^[:space:]]+ \(while verifying <[^[:space:]]+> from host \([^[:space:]]+\) \[[[:xdigit:].:]+\]:[[:digit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? Reverse DNS lookup failed for \[[[:xdigit:].:]+\] \((failed|deferred)\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP call from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ dropped: too many syntax or protocol errors .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP call from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ dropped: too many unrecognized commands .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP command timeout on( TLS)? connection from( [^[:space:]]+| \([^[:space:]]+\)| [^[:space:]]+ \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ closed by EOF$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ closed by QUIT$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ lost( \(error: Connection reset by peer\))? D=([[:digit:]]+[ms])+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ lost while reading message data( \(header\))?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP connection from \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \(TCP/IP connection count = [[:digit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP protocol error in "[^"]*" H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\))( \[[[:xdigit:].:]+\]:[[:digit:]]+)? I=\[[[:xdigit:].:]+\]:[[:digit:]]+ .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP syntax error in ".*" H=([^[:space:]]+ )?\[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? Start queue run: pid=[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): A disallowed SNI server name has been received\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): An unexpected TLS packet was received\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): A packet with illegal or unsupported version was received\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): A TLS record packet with invalid length was received\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Certificate is bad$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Decryption has failed\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Error decoding the received TLS packet\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Error in the (pull|push) function\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): No common application protocol could be negotiated\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): No supported cipher suites have been found\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): The specified session has been invalidated for some reason\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): timed out$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? unexpected disconnection while reading SMTP command from ([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( \(error: Connection reset by peer\))? D=([[:digit:]]+[ms])+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]: \[([2-9]|[[:digit:]]{2,})[\\/][[:digit:]]+\] .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Accepted MAIL FROM.*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Accepted RCPT TO [^[:space:]]+$
+#^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antiabuse_Scoring: rejected AUTH for [[:xdigit:].:]+ on port [[:digit:]]+ due to DNSBL IP score: [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Blacklists: domain [[:alnum:].-]+ is blacklisted at .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Blacklists: IP [[:xdigit:].:]+ is blacklisted at .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Check: reverse DNS host lookup failed$
+#^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Rejecting message from [^[:space:]]+ to [^[:space:]]+ via [[:xdigit:].:]+ due to DNSBL IP score: [[:digit:]]+$
+#^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Rejecting message from [^[:space:]]+ to [^[:space:]]+ via [[:xdigit:].:]+ due to rspamd score: [[:digit:].]+$
+#^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Rejecting message from [^[:space:]]+ to [^[:space:]]+ via [[:xdigit:].:]+ due to spamassassin score: [[:digit:].]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Summarized score is -?[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit: NOT delaying connection due to host [[:xdigit:].:]+ being on a whitelist$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit: NOT delaying connection due to sender being authenticated$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after AUTH for [[:digit:]]+s due to inconsistent setup score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after AUTH for [[:digit:]]+s due to IP DNSBL score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after connect for [[:digit:]]+s due to inconsistent setup score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after connect for [[:digit:]]+s due to IP DNSBL score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for [[:digit:]]+s due to domain DNSBL score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for [[:digit:]]+s due to inconsistent setup score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for [[:digit:]]+s due to IP DNSBL score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for -?[[:digit:]]+s due to rspamd score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for -?[[:digit:]]+s due to spamassassin score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after HELO [^[:space:]]+ for [[:digit:]]+s due to inconsistent setup score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after HELO [^[:space:]]+ for [[:digit:]]+s due to IP DNSBL score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after MAIL FROM [^[:space:]]* for [[:digit:]]+s due to domain DNSBL score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after MAIL FROM [^[:space:]]* for [[:digit:]]+s due to inconsistent setup score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after MAIL FROM [^[:space:]]* for [[:digit:]]+s due to IP DNSBL score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after RCPT TO [^[:space:]]* for [[:digit:]]+s due to domain DNSBL score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after RCPT TO [^[:space:]]* for [[:digit:]]+s due to inconsistent setup score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after RCPT TO [^[:space:]]* for [[:digit:]]+s due to IP DNSBL score$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Whitelists: domain [[:alnum:].-]+ is whitelisted at .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Whitelists: IP [[:xdigit:].:]+ is whitelisted at .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? AUTH allowed for [[:xdigit:].:]+ on port [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? AUTH requested from [[:xdigit:].:]+ on port (587|465)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Completed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: bad-commands
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: command-timeout$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: connection-lost$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: tls-failed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? DKIM: d=[^[:space:]]+ s=[^[:space:]]+ \[failed key import\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? DKIM: validation error: Public key signature verification has failed\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected after DATA: header syntax \(missing or malformed local part: failing address in "(From:|To:)" header is: .*\): missing or malformed local part: failing address in "(From:|To:)" header is: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected after DATA: header syntax \(unqualified address not permitted: failing address in "(From:|To:)" header is: .*\): unqualified address not permitted: failing address in "(From:|To:)" header is: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected after DATA: Rejected due to site policy reasons\. Contact postmaster in case of problems\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\](:[[:digit:]]+)? TLS error on connection \(recv\): Error in the pull function\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\](:[[:digit:]]+)? TLS error on connection \(recv\): The TLS connection was non-properly terminated\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? PRDR R=<[^[:space:]]+> acceptance$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Running acl_[^[:space:]]+ for (IP [[:xdigit:].:]+|domain [[:alnum:].-]+|user [[:alnum:]-]+)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? SMTP connection lost after final dot H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\] I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtps$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? SMTP connection lost after final dot [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: tls-failed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtpsa X=[^[:space:]]+ CV=(no|yes)( SNI=[^[:space:]]+)? A=(dovecot_plain|dovecot_login):[[:alnum:]:@.]+( PRDR)? S=[[:digit:]]+ id=[^[:space:]]+ from <[^[:space:]]+> for .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtp S=[[:digit:]]+( DKIM=[^[:space:]]+)? id=[^[:space:]]+ from <[^[:space:]]+> for [^[:space:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtps X=[^[:space:]]+ CV=(no|yes)( SNI=[^[:space:]]+)? S=[[:digit:]]+( DKIM=[^[:space:]]+)? id=[^[:space:]]+ from <[^[:space:]]+> for [^[:space:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? == [^[:space:]]+ routing defer \(-52\): retry time not reached$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? == [^[:space:]]+ R=[^[:space:]]+ T=[^[:space:]]+ defer \(-53\): retry time not yet reached$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? => [^[:space:]]+( <[^[:space:]]+>)? F=<[^[:space:]]+> P=<[^[:space:]]+> R=dnslookup T=remote_smtp H=[[:alnum:].-]+ \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( TFO)? X=[^[:space:]]+ CV=(no|yes) DN="[^"]+"( K)? C="[^"]+"$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? => [^[:space:]]+( <[^[:space:]]+>)? F=<[^[:space:]]+> P=<[^[:space:]]+> R=local_user T=deliver_pipe$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ U=[[:alnum:]]+ P=local S=[[:digit:]]+( id=[^[:space:]]+)? from <[^[:space:]]+> for .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? TLS error on connection from( [^[:space:]]+| \([^[:space:]]+\)| [^[:space:]]+ \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): The TLS connection was non-properly terminated\.(: syscall: Connection reset by peer)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-domain-score: [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-inconsistency-score: [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-ip-score: [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_bar: [/+-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_report: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_score: -?[[:digit:].]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_score_int: -?[[:digit:].]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_bar: [/+-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_report: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_score: -?[[:digit:].]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_score_int: -?[[:digit:].]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? Connection from \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ refused: too many connections from that IP address$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? (dovecot_login|dovecot_plain) authenticator failed for ([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+: 535 Incorrect authentication data( \(set_id=[[:alnum:]_@.-]+\))?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? End queue run: pid=[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? exim [[:digit:].]+ daemon started: pid=[[:digit:].]+, -q30m, listening for SMTP on port 25 \(IPv6 and IPv4\) port 587 \(IPv6 and IPv4\) and for SMTPS on port 465 \(IPv6 and IPv4\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ incomplete transaction \(connection lost\) from <[^[:space:]]+>( for .*)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ incomplete transaction \(QUIT\) from <[^[:space:]]+>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ incomplete transaction \(RSET\) from <[^[:space:]]+>( for [^[:space:]]+)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify defer for <[^[:space:]]+>: host lookup did not complete$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify defer for <[^[:space:]]+>: remote host address is the local host$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify fail for <[^[:space:]]+>: all relevant MX records point to non-existent hosts$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify fail for <[^[:space:]]+>: host lookup did not complete$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify fail for <[^[:space:]]+>: Unrouteable address$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-])? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Rejected due to site policy reasons\. Contact postmaster in case of problems\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Rejected for too many bad recipients$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: relay not permitted$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Sender verify failed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: SPF check failed\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Unrouteable address$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> temporarily rejected RCPT <[^[:space:]]+>: Could not complete sender verify$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? rejected AUTH (LOGIN|PLAIN): Rejected AUTH due to site policy reasons\. Disable SMTP AUTH and contact postmaster in case of problems\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? H=\[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ Warning: ACL "warn" statement skipped: condition test deferred: host lookup deferred for reverse lookup check$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? no host name found for IP address [[:xdigit:].:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? no MAIL in SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( D=([[:digit:]]+[ms])+)?( X=[^[:space:]]+ CV=no)?( SNI=[^[:space:]]+)?( C=(HELO|EHLO|STARTTLS|AUTH|QUIT|RSET|HELP|,)+)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? rejected (EHLO|HELO) from( [^[:space:]]+)? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+: syntactically invalid argument\(s\): \(no argument given\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? REJECT \[[[:xdigit:].:]+\]: bad recipient count high \[[[:digit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? remote host address is the local host: [^[:space:]]+ \(while verifying <[^[:space:]]+> from host \([^[:space:]]+\) \[[[:xdigit:].:]+\]:[[:digit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? Reverse DNS lookup failed for \[[[:xdigit:].:]+\] \((failed|deferred)\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP call from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ dropped: too many syntax or protocol errors .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP call from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ dropped: too many unrecognized commands .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP command timeout on( TLS)? connection from( [^[:space:]]+| \([^[:space:]]+\)| [^[:space:]]+ \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ closed by EOF$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ closed by QUIT$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ lost( \(error: Connection reset by peer\))? D=([[:digit:]]+[ms])+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ lost while reading message data( \(header\))?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP connection from \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \(TCP/IP connection count = [[:digit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP protocol error in "[^"]*" H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\))( \[[[:xdigit:].:]+\]:[[:digit:]]+)? I=\[[[:xdigit:].:]+\]:[[:digit:]]+ .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? SMTP syntax error in ".*" H=([^[:space:]]+ )?\[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? Start queue run: pid=[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): A disallowed SNI server name has been received\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): An unexpected TLS packet was received\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): A packet with illegal or unsupported version was received\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): A TLS record packet with invalid length was received\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Certificate is bad$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Decryption has failed\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Error decoding the received TLS packet\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Error in the (pull|push) function\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): No common application protocol could be negotiated\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): No supported cipher suites have been found\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): The specified session has been invalidated for some reason\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): timed out$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:.]+ \[[[:digit:]]+\])? unexpected disconnection while reading SMTP command from ([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( \(error: Connection reset by peer\))? D=([[:digit:]]+[ms])+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ exim\[[[:digit:]]+\]: \[([2-9]|[[:digit:]]{2,})[\\/][[:digit:]]+\] .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ fstrim\[[[:digit:]]+\]: [[:alnum:]./-]+: [[:digit:].]+ ([KMGT]i)?B \([[:digit:]]+ bytes\) trimmed on [[:alnum:]./-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ fstrim\[[[:digit:]]+\]: [[:alnum:]./-]+: [[:digit:].]+ ([KMGT]i)?B \([[:digit:]]+ bytes\) trimmed on [[:alnum:]./-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ gitolite\[[[:digit:]]+\]\[[[:digit:]]+\]: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ gitolite\[[[:digit:]]+\]\[[[:digit:]]+\]: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.11: associated \(aid [[:digit:]]\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.11: authenticated$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.11: deauthenticated due to inactivity \(timer DEAUTH/REMOVE\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802.11: did not acknowledge authentication response$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.11: disassociated$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.11: disassociated due to inactivity$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.1X: authenticated - EAP type: 25 \(PEAP\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.1X: authenticated - EAP type: 25 \(PEAP\) \(PMKSA cache\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ RADIUS: starting accounting session [[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ RADIUS: stopped accounting session [[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ RADIUS: VLAN ID [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ WPA: group key handshake completed \(RSN\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ WPA: pairwise key handshake completed \(RSN\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.11: associated \(aid [[:digit:]]\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.11: authenticated$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.11: deauthenticated due to inactivity \(timer DEAUTH/REMOVE\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802.11: did not acknowledge authentication response$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.11: disassociated$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.11: disassociated due to inactivity$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.1X: authenticated - EAP type: 25 \(PEAP\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ IEEE 802\.1X: authenticated - EAP type: 25 \(PEAP\) \(PMKSA cache\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ RADIUS: starting accounting session [[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ RADIUS: stopped accounting session [[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ RADIUS: VLAN ID [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ WPA: group key handshake completed \(RSN\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ hostapd: [[:alnum:]]+: STA [[:xdigit:]:]+ WPA: pairwise key handshake completed \(RSN\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ icinga: Auto-save of retention data completed successfully\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ icinga: LOG ROTATION: DAILY$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ icinga: LOG VERSION: [[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ icinga: CURRENT HOST STATE: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ icinga: CURRENT SERVICE STATE: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ icinga: Auto-save of retention data completed successfully\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ icinga: LOG ROTATION: DAILY$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ icinga: LOG VERSION: [[:digit:].]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ icinga: CURRENT HOST STATE: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ icinga: CURRENT SERVICE STATE: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ init: Trying to re-exec init$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ init: Trying to re-exec init$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] unknown INPUT traffic: IN=[[:alnum:]]+ OUT= MAC=[[:xdigit:]:.]+ SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP|132|41|155|253)( SPT=[[:digit:]]+ DPT=[[:digit:]]+ (WINDOW=[[:digit:]]+ RES=0x[[:xdigit:]]+ (CWR )?(ECE )?(PSH )?(SYN |ACK |RST )+(PSH )?URGP=[[:digit:]]+|LEN=[[:digit:]]+))?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] [[:alnum:]]+ bruteforce attempt: IN=[[:alnum:]]+ OUT= MAC=[[:digit:]a-f:]+ SRC=[[:digit:]a-f:.]+ DST=[[:digit:]a-f:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP) SPT=[[:digit:]]+ DPT=[[:digit:]]+ (WINDOW=[[:digit:]]+ RES=0x00 (CWR ECE )?(SYN|ACK|RST) (PSH )?(FIN )??URGP=[[:digit:]]+|LEN=[[:digit:]]+)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] unknown INPUT traffic: IN=[[:alnum:]]+ OUT= MAC=[[:xdigit:]:.]+ SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP|132|41|155|253)( SPT=[[:digit:]]+ DPT=[[:digit:]]+ (WINDOW=[[:digit:]]+ RES=0x[[:xdigit:]]+ (CWR )?(ECE )?(PSH )?(SYN |ACK |RST )+(PSH )?URGP=[[:digit:]]+|LEN=[[:digit:]]+))?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] [[:alnum:]]+ bruteforce attempt: IN=[[:alnum:]]+ OUT= MAC=[[:digit:]a-f:]+ SRC=[[:digit:]a-f:.]+ DST=[[:digit:]a-f:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP) SPT=[[:digit:]]+ DPT=[[:digit:]]+ (WINDOW=[[:digit:]]+ RES=0x00 (CWR ECE )?(SYN|ACK|RST) (PSH )?(FIN )??URGP=[[:digit:]]+|LEN=[[:digit:]]+)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] USB Video Class driver \(1\.1\.1\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] lp: driver loaded but no devices found$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i2c /dev entries driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Asymmetric key parser 'pkcs8' registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] loop: module loaded$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EXT4-fs \([[:alnum:]-]+\): mounted filesystem with ordered data mode\. Opts: acl$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EXT4-fs \([[:alnum:]-]+\): re-mounted\. Opts: acl,errors=remount-ro$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: Core ver 2\.22$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: HCI device and connection manager initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: HCI socket layer initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: L2CAP socket layer initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: SCO socket layer initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM: chip id 63$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM: features 0x07$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM20702A$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM20702A1 \(001\.002\.014\) build 0000$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: BNEP \(Ethernet Emulation\) ver 1\.3$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: BNEP filters: protocol multicast$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: BNEP socket layer initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Initializing XFRM netlink socket
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] 00:0[[:digit:]]: ttyS[[:digit:]] at I/O 0x[[:digit:]]f8 \(irq = [[:digit:]], base_baud = 115200\) is a 16550A$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] 8021q: 802.1Q VLAN Support v1.8$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] 8021q: adding VLAN 0 to HW filter on device [[:alnum:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Added _OSI.*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: (APIC|DBG2|DBGP|DMAR|DSDT|FACP|FACS|FIDT|FPDT|HEST|HPET|IVRS|LPIT|MCFG|OEMB|RSDP|RSDT|SSDT|TPM2|UEFI|XSDT)( 0x[[:xdigit:]]+ [[:xdigit:]]+( \(v[[:digit:]]+ .*\))?)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: TCPA 0x[[:xdigit:]]+ 000032 \(v02 COREv4 COREBOOT 00000000 CORE 20200110\)
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: bus type PCI registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: bus type USB registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Core revision [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpi_cpufreq: overriding BIOS provided _PSD data$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: [[:digit:]] ACPI AML tables successfully acquired and loaded$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: duty_cycle spans bit 4$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Dynamic OEM Table Load:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Early table checksum verification disabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Enabled [[:digit:]]+ GPEs in block [[:xdigit:]]+ to [[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI FADT declares the system doesn't support PCIe ASPM, so disable it$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: HPET id: 0x[[:xdigit:]]+ base: 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Interpreter enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: INT_SRC_OVR \(bus 0 bus_irq [[:digit:]]+ global_irq [[:digit:]]+ dfl dfl\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: INT_SRC_OVR \(bus 0 bus_irq [[:digit:]]+ global_irq [[:digit:]]+ high level\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: INT_SRC_OVR \(bus 0 bus_irq [[:digit:]]+ global_irq [[:digit:]]+ low level\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: IRQ[[:digit:]]+ used by override\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: LAPIC_NMI \(acpi_id\[0x[[:xdigit:]]+\] dfl dfl lint\[0x1\]\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: LAPIC_NMI \(acpi_id\[0x[[:xdigit:]]+\] high edge lint\[0x1\]\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Local APIC address 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Low-level resume complete$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: PCI Interrupt Link \[(INT|LNK)[[:alpha:]]\] \(IRQs [[:digit:][:space:]*]+\)( [[:digit:]*]+)?(, disabled\.)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: PCI Root Bridge \[PCI0\] \(domain 0000 \[bus 00-[[:xdigit:]]+\]\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpiphp: Slot \[[[:digit:]]+\] registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: PM-Timer IO Port: 0x[[:xdigit:]]+V?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpi PNP0A0[[:digit:]]:00: _OSC: OS supports \[ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpi PNP0A0[[:digit:]]:00: _OSC: OS now controls \[PCIeHotplug SHPCHotplug PME AER PCIeCapability LTR\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Power Button \[PWRB\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Power Button \[PWRF\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Power Resource \[(FN[[:digit:]]+|PG[[:digit:]]+|WRST|FPWR)\] \((off|on)\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: \\_PR_\.CPU0: _OSC native thermal LVT Acked$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Preparing to enter system sleep state S3$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: \\_PR_\.P[[:digit:]]+: Found 2 idle states$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Reserving (APIC|ASF!|DBG2|DBGP|DMAR|DSDT|FACP|FACS|FIDT|FPDT|HEST|HPET|IVRS|LPIT|MCFG|OEMB|SSDT|TCPA|TPM2|UEFI) table memory at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Sleep Button \[SLPB\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: \(supports( S[[:digit:]])+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Thermal Zone \[TZ[[:digit:]]+\] \([[:digit:]]+ C\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Using IOAPIC for interrupt routing$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Video Device \[GFX0\] \(multi-head: yes rom: no post: no\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Waking up from system sleep state S3$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Adding [[:digit:]]+k swap on [^.]+\. Priority:-2 extents:1 across:[[:digit:]]+k (SS)?FS$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AES CTR mode by8 optimization enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AGP: Checking aperture\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AGP: No AGP bridge found$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AGP: Node 0: aperture \[bus addr 0x28e6000000-0x28e7ffffff\] \(32MB\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ahci 0000:00:[[:xdigit:]]+.[[:digit:]]: AHCI 0001.[[:digit:]]+ 32 slots [[:digit:]] ports [[:digit:]] Gbps 0x[[:xdigit:]]+ impl SATA mode$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ahci 0000:00:[[:xdigit:]]+.[[:digit:]]: flags: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ahci 0000:00:[[:xdigit:]]+.[[:digit:]]: version 3.0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]_]+ 0000:0[[:digit:]]:[[:xdigit:]]{2}\.[[:xdigit:]] [[:alnum:]]+: renamed from [[:alnum:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: associate with [[:xdigit:]:]+ \(try [[:digit:]]/3\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: authenticate with [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: authenticate with [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: authentication with [[:xdigit:]:]+ timed out$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: deauthenticated from [[:xdigit:]:]+ \(Reason: 3=DEAUTH_LEAVING\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+ filesystem being mounted at /[[:alnum:]]+ supports timestamps until 2038 \(0x[[:xdigit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:].]+: port [[:digit:]]+\([[:alnum:].]+\) entered (disabled|blocking|forwarding) state$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: send auth to [[:xdigit:]:+ \(try [[:digit:]]/3\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AMD64 EDAC driver v3.5.0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] amd_uncore: 4 amd_l2 counters detected$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] amd_uncore: 4 amd_nb counters detected$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Aperture beyond 4GB\. Ignoring\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] APIC: Switch to symmetric I/O mode setup$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AppArmor: AppArmor Filesystem Enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AppArmor: AppArmor initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AppArmor: AppArmor sha1 policy hashing enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Asymmetric key parser 'x509' registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] async_tx: api initialized \(async\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] at24 0-[[:digit:]]+: 256 byte spd EEPROM, read-only$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] at24 0-[[:digit:]]+: supply vcc not found, using dummy regulator$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata1.00: SB600 AHCI: limiting to 255 sectors per cmd$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: applying PMP SRST workaround and retrying$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:].]+: configured for UDMA/[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]].[[:digit:]]+: ATA-[[:digit:]]+: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]].[[:digit:]]+: ATAPI: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]].[[:digit:]]+: [[:digit:]]+ sectors, multi [[:digit:]]+: LBA48( NCQ \(depth 32\), AA)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:].]+: disabling queued TRIM support$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: DUMMY$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:].]+: Enabling discard_zeroes_data$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: PATA max MWDMA2 cmd 0x[[:xdigit:]]+ ctl 0x376 bmdma 0x[[:xdigit:]]+ irq [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: PATA max UDMA/100 cmd 0x[[:xdigit:]]+ ctl 0x3f6 bmdma 0xff00 irq [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: SATA link down \(SStatus 0 SControl 300\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: SATA link up [[:digit:].]+ Gbps \(SStatus [[:digit:]]+ SControl 300\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: SATA max UDMA/133 abar m[[:digit:]]+@0x[[:xdigit:]]+ port 0x[[:xdigit:]]+ irq [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: softreset failed \(device not ready\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:].]+: supports DRM functions and may not be fully accessible$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata_piix 0000:00:01.1: version 2.13$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: Country alpha2 being used: US$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: country maps to regdmn code: 0x3a$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: doing EEPROM country->regdmn map search$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: EEPROM indicates default country code should be used$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: EEPROM regdomain: 0x0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: Regpair used: 0x3a$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ATOM BIOS: ATI$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] audit: type=1400 audit\([[:digit:].:]+\): apparmor="STATUS" operation="profile_load" profile="unconfined" .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AVX2 version of gcm_enc/dec engaged.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AVX version of gcm_enc/dec engaged.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] ACPI data$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] ACPI NVS$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] reserved$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] usable$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] type 16$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-provided physical RAM map:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. bit width: 48$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Block layer SCSI generic \(bsg\) driver version 0.4 loaded \(major [[:digit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BOOT_IMAGE=/vmlinuz-.*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Booting paravirtualized kernel on bare hardware$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Booting paravirtualized kernel on KVM$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Built 1 zonelists, mobility grouping on. Total pages: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] bus: 00 \[io 0x0000-0xffff\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] bus: 00 \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] bus: \[bus 00-ff\] on node 0 link 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Calibrating delay loop \(skipped\) preset value.. [[:digit:].]+ BogoMIPS \(lpj=[[:digit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Calibrating delay loop \(skipped\), value calculated using timer frequency.. [[:digit:].]+ BogoMIPS \(lpj=[[:digit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] caller pci_map_rom\+0x[[:xdigit:]]+/0x[[:xdigit:]]+ mapping multiple BARs$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ccp 0000:00:[[:xdigit:]]+.0: ccp enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ccp 0000:00:[[:xdigit:]]+.0: [[:digit:]] command queues available$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cdrom: Uniform CD-ROM driver Revision: 3.20$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cfg80211: Loaded X.509 cert .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cfg80211: Loading compiled-in X.509 certificates for regulatory database$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] clocksource: (acpi_pm|hpet|jiffies|kvm-clock|refined-jiffies|tsc-early|tsc): mask: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] clocksource: Switched to clocksource (acpi_pm|hpet|jiffies|kvm-clock|refined-jiffies|tsc-early|tsc)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Command line: BOOT_IMAGE=.*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Console: colour dummy device 80x25$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Console: colour VGA\+ 80x25$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Console: switching to colour dummy device 80x25$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Console: switching to colour frame buffer device 240x75$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] CPU[[:digit:]] is up$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cpuidle: using governor (ladder|menu)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cryptd: max_cpu_qlen set to 1000$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] dca service started, version 1.12.1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Dentry cache hash table entries: [[:digit:]]+ \(order: [[:digit:]]+, [[:digit:]]+ bytes, linear\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Detected use of extended apic ids on hypertransport bus$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? device [[:alnum:].]+ (entered|left) promiscuous mode$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Device empty$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] device-mapper: ioctl: 4.43.0-ioctl \(2020-10-01\) initialised: dm-devel@redhat.com$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] device-mapper: uevent: version 1.0.3$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] devtmpfs: initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ( #[[:digit:]])+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:digit:]] base [[:xdigit:]]+ mask [[:xdigit:]]+ (uncachable|write-back|write-protect|write-combining)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:digit:]] disabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Disabling|Enabling) non-boot CPUs \.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMA: preallocated [[:digit:]]+ KiB GFP_KERNEL(\|GFP_DMA(32)?)? pool for atomic allocations$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: dmar[[:digit:]]: reg_base_addr [[:xdigit:]]+ ver 1:0 cap [[:xdigit:]]+ ecap [[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: dmar[[:digit:]]: Using Queued invalidation$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: DRHD base: 0x[[:xdigit:]]+ flags: 0x[[:xdigit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: Host address width [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: Intel\(R\) Virtualization Technology for Directed I/O$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR-IR: Enabled IRQ remapping in x2apic mode$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR-IR: HPET id 0 under DRHD base 0xfed91000$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR-IR: IOAPIC id [[:digit:]]+ under DRHD base 0xfed91000 IOMMU 1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR-IR: Queued invalidation will be enabled to support x2apic and Intr-remapping\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: No ATSR found$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: RMRR base: 0x[[:xdigit:]]+ end: 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: LENOVO 2325CT4/2325CT4, BIOS CBET4000 4.12-375-g7729b29a58 05/28/2020$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: MICRO-STAR INTERANTIONAL CO\.,LTD MS-7368/MS-7368, BIOS V1\.5B2 10/31/2007$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: PC Engines apu2/apu2, BIOS v4\.11\.0\.1 12/09/2019$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: System manufacturer System Product Name/P8H67-M PRO, BIOS 9005 09/18/2018$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: MSI MS-7816/H87-G43 \(MS-7816\), BIOS V2\.14B15 05/20/2019$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] done\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Connector [[:digit:]]:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] CRT1: INTERNAL_KLDSCP_DAC1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] DDC: 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Detected VRAM RAM=128M, BAR=128M$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] DFP3: INTERNAL_LVTM1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Encoders:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] GART: num cpu pages 131072, num gpu pages 131072$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] HDMI-A-1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Initialized i915 1.6.0 20200917 for 0000:00:02.0 on minor 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Initialized radeon 2.50.0 20080528 for 0000:01:05.0 on minor 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] initializing kernel modesetting \(RS690 0x1002:0x791E 0x1462:0x7327 0x00\)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Loading RS690/RS740 Microcode$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] PCIE GART of 512M enabled \(table at 0x[[:xdigit:]]+\)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon: 128M of VRAM memory ready$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon: 1 quad pipes, 1 z pipes initialized\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon: 512M of GTT memory ready.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon: cp finalized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Radeon Display Connectors$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon: irq initialized.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon kernel modesetting enabled.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] RAM width 128bits DDR$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] SVIDEO-1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] TV1: INTERNAL_KLDSCP_DAC1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] VGA-1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6 0000:00:1f\.6 \(uninitialized\): registered PHC clock$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6 [[:alnum:]]+: Intel\(R\) PRO/1000 Network Connection$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6 [[:alnum:]]+: MAC: 12, PHY: 12, PBA No: FFFFFF-0FF$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6 [[:alnum:]]+: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6 [[:alnum:]]+: \(PCI Express:2.5GT/s:Width x1\) [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6: Interrupt Throttling Rate \(ints/sec\) set to dynamic conservative mode$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e: Copyright\(c\) 1999 - 2015 Intel Corporation\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e: Intel\(R\) PRO/1000 Network Driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e820: remove \[mem 0x000a0000-0x000fffff\] usable$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e820: reserve RAM buffer \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e820: update \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] usable ==> reserved$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Early memory node ranges$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: F16h_M30h detected \(node 0\)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: K8 revF or later detected \(node 0\)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: MC: [[:digit:]]: [[:digit:][:space:]]+MB [[:digit:]]: 0MB$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: MCT channel count: 1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: Node 0: DRAM ECC disabled.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: Node 0: DRAM ECC enabled.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: using x4 syndromes.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC MC0: Giving out device to module amd64_edac controller F16h_M30h: DEV 0000:00:18.3 \(INTERRUPT\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC MC: DCT[[:digit:]] chip selects:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC MC: Ver: 3.0.0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC PCI0: Giving out device to module amd64_edac controller EDAC PCI controller: DEV 0000:00:18.2 \(POLLED\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ee1004 0-[[:digit:]]+: 512 byte EE1004-compliant SPD EEPROM, read-only$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci_hcd: USB 2.0 'Enhanced' Host Controller \(EHCI\) Driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: applying AMD SB600/SB700 USB freeze workaround$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: debug port [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: EHCI Host Controller$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: irq [[:digit:]]+, io mem 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: new USB bus registered, assigned bus number [[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: USB 2.0 started, EHCI 1.00$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci: EHCI PCI platform driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. event mask: [[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] f71882fg f71882fg.1536: Fan: [[:digit:]] is in duty-cycle mode$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] f71882fg: Found f71882fg chip at 0x600, revision 32$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] fbcon: i915drmfb \(fb0\) is primary device$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Filesystems sync: [[:digit:].]+ seconds$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. fixed-purpose events: [[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] found SMP MP-table at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing initrd memory: [[:digit:]]+K$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing SMP alternatives memory: [[:digit:]]+K?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing unused decrypted memory: [[:digit:]]+K$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing unused kernel image \(initmem\) memory: [[:digit:]]+K$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing unused kernel image \(rodata/data gap\) memory: [[:digit:]]+K$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing unused kernel image \(text/rodata gap\) memory: [[:digit:]]+K$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freezing remaining freezable tasks \.\.\. \(elapsed [[:digit:].]+ seconds\) done\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freezing user space processes \.\.\. \(elapsed [[:digit:].]+ seconds\) done\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] FS-Cache: Loaded$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] FS-Cache: Netfs 'nfs' registered for caching$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ftrace: allocated [[:digit:]]+ pages with [[:digit:]]+ groups$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ftrace: allocating [[:digit:]]+ entries in [[:digit:]]+ pages$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] fuse: init \(API version 7.32\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] futex hash table entries: [[:digit:]]+ \(order: [[:digit:]]+, [[:digit:]]+ bytes, linear\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. generic registers: [[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] generic_sse : [[:digit:]]+ MB/sec$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] HEST: Table parsing has been initialized\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hid-generic 0003:0B05:189D.0001: No inputs registered, leaving$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hid: raw HID events driver \(C\) Jiri Kosina$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] HOME=/$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hpet0: at MMIO 0xfed00000, IRQs [[:digit:][:space:],]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hpet0: [[:digit:]] comparators, (64|32)-bit [[:digit:].]+ MHz counter$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hub [[:digit:]]-[[:digit:]]:1.0: [[:digit:]]+ ports detected$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hub [[:digit:]]-[[:digit:]]:1.0: USB hub found$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] HugeTLB registered [[:digit:]]+.00 [MG]iB page size, pre-allocated 0 pages$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Hypervisor detected: KVM$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i2c i2c-0: [[:digit:]]/4 memory slots populated \(from DMI\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i2c i2c-0: Successfully instantiated SPD at 0x5[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i801_smbus 0000:00:1f\.[[:digit:]]: enabling device \(0001 -> 0003\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i801_smbus 0000:00:1f\.[[:digit:]]: SMBus using PCI interrupt$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i801_smbus 0000:00:1f\.[[:digit:]]: SPD Write Disable is set$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i8042: No controller found$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i8042: PNP: No PS/2 controller found\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i8042: PNP: PS/2 Controller \[PNP0303:KBD,PNP0f13:MOU\] at 0x60,0x64 irq 1,12$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i8042: PNP: PS/2 Controller \[PNP0303:PS2K\] at 0x60,0x64 irq 1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i8042: Probing ports directly\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i915 0000:00:02\.0: \[drm\] DMAR active, disabling use of stolen memory$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i915 0000:00:02\.0: \[drm\] DMC firmware homepage: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i915 0000:00:02\.0: \[drm\] fb0: i915drmfb frame buffer device$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i915 0000:00:02\.0: \[drm\] VT-d active for gfx access$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i915 0000:00:02\.0: vgaarb: changed VGA decodes: olddecodes=io\+mem,decodes=io\+mem:owns=io\+mem$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (i915|radeon) 0000:0[[:digit:]]:0[[:digit:]]\.0: vgaarb: deactivate vga console$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ieee80211 phy0: Atheros AR9280 Rev:2 mem=0x[[:xdigit:]]+, irq=58$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0: added PHC on eth[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0 [[:alnum:]]+: igb: [[:alnum:]]+ NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX(/TX)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0: [[:alnum:]]+: PBA No: FFFFFF-0FF$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0: [[:alnum:]]+: \(PCIe:2.5Gb/s:Width x1\) [[:xdigit:]:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0: Intel\(R\) Gigabit Ethernet Network Connection$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0: Using MSI-X interrupts. 4 rx queue\(s\), 4 tx queue\(s\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb: Copyright \(c\) 2007-2014 Intel Corporation\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb: Intel\(R\) Gigabit Ethernet Network Driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] /init$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Initialise system trusted keyrings$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Initmem setup node 0 \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Inode-cache hash table entries: [[:digit:]]+ \(order: [[:digit:]]+, [[:digit:]]+ bytes, linear\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA ATI HDMI HDMI/DP,pcm=3 as /devices/pci0000:00/0000:00:01.0/0000:01:05.2/sound/card0/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH Front Headphone as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH Front Mic as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH HDMI/DP,pcm=[[:digit:]]+ as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input1[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH Line as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH Line Out as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH Rear Mic as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: PC Speaker as /devices/platform/pcspkr/input/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: Power Button as /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0C:00/input/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: PRP0001:00 as /devices/pci0000:00/PRP0001:00/input/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: Sleep Button as /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0E:00/input/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: Video Bus as /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/LNXVIDEO:00/input/input[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Installing knfsd \(copyright \(C\) 1996 okir@monad\.swb\.de\)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] integrity: Platform Keyring initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_idle: Local APIC timer is reliable in all C-states$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_idle: MWAIT substates: 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_idle: v0.5.1 model 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_pmc_core INT33A1:00: initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_pstate: CPU model not supported$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_pstate: HWP enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_pstate: Intel P-state driver initializing$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_rapl_common: Found RAPL domain core$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_rapl_common: Found RAPL domain dram$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_rapl_common: Found RAPL domain package$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_rapl_common: Found RAPL domain uncore$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] IOAPIC\[[[:digit:]]\]: apic_id [[:digit:]]+, version [[:digit:]]+, address 0x[[:xdigit:]]+, GSI [[:digit:]]+-[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iommu: Default domain type: Translated$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] io scheduler mq-deadline registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] IP idents hash table entries: [[:digit:]]+ \(order: [[:digit:]]+, [[:digit:]]+ bytes, linear\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] IPI shorthand broadcast: enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] IPv6: ADDRCONF\(NETDEV_CHANGE\): [[:alnum:]]+: link becomes ready$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] IRQ [[:digit:]]+: no longer affine to CPU[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iTCO_vendor_support: vendor-support=0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iTCO_wdt: Found a Intel PCH TCO device \(Version=4, TCOBASE=0x0400\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iTCO_wdt: Found a Lynx Point TCO device \(Version=2, TCOBASE=0x1860\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iTCO_wdt: initialized. heartbeat=30 sec \(nowayout=0\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iTCO_wdt: Intel TCO WatchDog Timer Driver v1.11$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iwlwifi [[:xdigit:]:]+: Radio type=[[:xdigit:]x-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kauditd_printk_skb: [[:digit:]]+ callbacks suppressed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Kernel command line: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Kernel/User page tables isolation: enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Key type asymmetric registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Key type blacklist registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Key type fscrypt-provisioning registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Key type ._fscrypt registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Key type .fscrypt registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Kprobes globally optimized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-clock: cpu [[:digit:]], msr [[:xdigit:]]+, (primary|secondary) cpu clock$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-clock: Using msrs [[:xdigit:]]+ and [[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-clock: using sched offset of [[:digit:]]+ cycles$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-guest: KVM setup pv remote TLB flush$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-guest: PV spinlocks enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-guest: setup PV IPIs$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-guest: stealtime: cpu [[:digit:]], msr [[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm: Nested Virtualization enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Last level (dTLB|iTLB) entries: 4KB [[:digit:]]+, 2MB [[:digit:]]+, 4MB [[:digit:]]+, 1GB [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] last_pfn = 0x[[:xdigit:]]+ max_arch_pfn = 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ledtrig-cpu: registered to indicate activity on CPUs$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Linux agpgart interface v0.103$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Linux version .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Loaded X.509 cert '.*'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Loading compiled-in X.509 certificates$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] LSM: Security Framework initializing$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] LVT offset [[:digit:]] assigned for vector 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. max period: [[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mce: CPU0: Thermal monitoring enabled \(TM1\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] MCE: In-kernel MCE decoding enabled.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mc: Linux media interface: v0.10$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] md[[:digit:]]+: detected capacity change from 0 to [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] md/raid1:md[[:digit:]]+: active with 2 out of 2 mirrors$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mei_me 0000:00:16.0: enabling device \(0000 -> 0002\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] available for PCI devices$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mem auto-init: stack:off, heap alloc:on, heap free:off$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Memory: [[:digit:]]+K/[[:digit:]]+K available \([[:digit:]]+K kernel code, [[:digit:]]+K rwdata, [[:digit:]]+K rodata, [[:digit:]]+K init, [[:digit:]]+K bss, [[:digit:]]+K reserved, 0K cma-reserved\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] microcode: CPU[[:digit:]]: patch_level=0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] microcode: microcode updated early to revision 0x[[:xdigit:]]+, date = [[:digit:]-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] microcode: Microcode Update Driver: v2.2\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] microcode: sig=0x[[:xdigit:]]+, pf=0x[[:xdigit:]]+, revision=0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mip6: Mobile IPv6$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Mountpoint-cache|Mount-cache) hash table entries: [[:digit:]]+ \(order: [[:digit:]], [[:digit:]]+ bytes, linear\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mousedev: PS/2 mouse device common for all mice$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Movable zone start for each node$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mpls_gso: MPLS GSO support$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mtrr: corrected configuration.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] MTRR default type: uncachable$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] MTRR default type: write-back$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] MTRR fixed ranges enabled:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] MTRR variable ranges enabled:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] nct6775: Found NCT6779D or compatible chip at 0x4e:0xa00$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NetLabel: domain hash size = 128$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NetLabel: Initializing$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NetLabel: unlabeled traffic allowed by default$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] nfsd: last server has exited, flushing export cache$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NFSD: starting 90-second grace period \(net [[:xdigit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NFSD: Using UMH upcall client tracking operations\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NMI watchdog: Enabled\. Permanently consumes one hw-PMU counter\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\.\. node #0, CPUs:.*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] node 0 deferred pages initialised in [[:digit:]]+ms$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] node 0 link 0: io port \[[[:xdigit:]]+, [[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] node 0 link 0: mmio \[[[:xdigit:]]+, [[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] node 0: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NODE_DATA\(0\) allocated \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] No NUMA configuration found$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Normal|DMA(32)?)[[:space:]]+\[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Normal|DMA(32)?) zone: [[:digit:]]+ pages, LIFO batch:[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Normal|DMA(32)?) zone: [[:digit:]]+ pages reserved$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Normal|DMA(32)?) zone: [[:digit:]]+ pages used for memmap$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Normal empty$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NR_IRQS: 524544, nr_irqs: [[:digit:]]+, preallocated irqs: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NX \(Execute Disable\) protection: active$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ohci_hcd: USB 1.1 'Open' Host Controller \(OHCI\) Driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ohci-pci 0000:00:13.[[:digit:]]: irq [[:digit:]]+, io mem 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ohci-pci 0000:00:13.[[:digit:]]: new USB bus registered, assigned bus number [[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ohci-pci 0000:00:13.[[:digit:]]: OHCI PCI host controller$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ohci-pci: OHCI PCI platform driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] On node 0 totalpages: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] On node 0, zone (DMA(32)?|Normal): [[:digit:]]+ pages in unavailable ranges$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] on the kernel command line$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] OOM killer (enabled|disabled)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] parport0: PC-style at 0x378, irq 5 \[PCSPP\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] parport0: PC-style at 0x378, irq 5 \[PCSPP,TRISTATE,EPP\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] parport_pc 00:0[[:digit:]]: reported by Plug and Play ACPI$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (parport_pc|serial) [[:digit:]:]+: (activated|disabled)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:00\.0: disabling ASPM on pre-1\.1 PCIe device\. You can enable it with 'pcie_aspm=force'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Activating ISA DMA hang workarounds$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Adding to iommu group [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: BAR [[:digit:]]+: assigned \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: BAR [[:digit:]]+: assigned \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: BAR [[:digit:]]+: assigned \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ 64bit pref\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: BAR [[:digit:]]+: assigned \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ pref\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] to \[bus 01\] add_size 1000$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+ window\] \(subtractive decode\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ 64bit pref\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ 64bit pref\] to \[bus 01\] add_size 200000 add_align 100000$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] to \[bus 01\] add_size 200000 add_align 100000$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ window\] \(subtractive decode\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Disabling ASPM L0s/L1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: enabling Extended Tags$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Enabling MPC IRBNCE$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Intel PCH root port ACS workaround enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: legacy IDE quirk: reg 0x[[:xdigit:]]+: \[io 0x[[:xdigit:]]+(-0x[[:xdigit:]]+)?\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Limiting direct PCI/PCI transfers$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI host bridge to bus 0000:00$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: PCI bridge to \[bus [[:digit:]-]+\]( \(subtractive decode\))?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: PIIX3: Enabling Passive Release$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: PME# supported from .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ 64bit\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ 64bit pref\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ pref\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: supports [[:alnum:][:space:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: vgaarb: bridge control possible$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: vgaarb: setting as boot VGA device$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: vgaarb: VGA device added: decodes=io\+mem,owns=io\+mem,locks=none$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Video device with shadowed ROM at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: \[[[:xdigit:]]+:[[:xdigit:]]+\] type [[:digit:]]+ class 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:[[:xdigit:]]{2}:[[:xdigit:]]{2}\.[[:xdigit:]]: PCI bridge to \[bus [[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[bus 00-[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+( window)?\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+( window| 64bit| pref)*\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:[[:xdigit:]]+: Allocating resources$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: CLS [[:digit:]]+ bytes, default 64$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI-DMA: Using software bounce buffering for IO \(SWIOTLB\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:].]+: (AER|PME): enabled with IRQ [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:]]+\.[[:digit:]]: Enabling MPC IRBNCE$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:]]+\.[[:digit:]]: Intel PCH root port ACS workaround enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:].]+: pciehp: Slot #0 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug\+ Surprise\+ Interlock- NoCompl\+ IbPresDis- LLActRep\+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:].]+: PME: Signaling with IRQ [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI Interrupt Link \[LNK[CD]\] enabled at IRQ [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: MMCONFIG at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] reserved in ACPI motherboard resources$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: MMCONFIG at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] reserved in E820$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: MMCONFIG for domain 0000 \[bus 00-[[:xdigit:]]+\] at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] \(base 0x[[:xdigit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: pci_cache_line_size set to 64 bytes$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: Using ACPI for IRQ routing$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: Using configuration type 1 for base access$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcpu-alloc: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] percpu: Embedded [[:digit:]]+ pages/cpu .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] perf: AMD IBS detected \(0x000000ff\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] perf: interrupt took too long ([[:digit:]]+ > [[:digit:]]+), lowering kernel.perf_event_max_sample_rate to [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Performance Events: AMD PMU driver\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Performance Events: Haswell events, full-width counters, Intel PMU driver\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Performance Events: PEBS fmt[[:digit:]]\+, [[:alpha:]]+ events, [[:digit:]]+-deep LBR, full-width counters, Intel PMU driver\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pid_max: default: 32768 minimum: 301$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] piix4_smbus 0000:00:14.0: Auxiliary SMBus Host Controller at 0xb20$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] piix4_smbus 0000:00:14.0: SMBus Host Controller at 0xb00, revision 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] piix4_smbus 0000:00:14.0: Using register 0x02 for SMBus port selection$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pinctrl core: initialized pinctrl subsystem$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] platform regulatory.0: firmware: direct-loading firmware regulatory.db$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] platform regulatory.0: firmware: direct-loading firmware regulatory.db.p7s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: hibernation: Registered nosave memory: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: Registering ACPI NVS region \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] \([[:digit:]]+ bytes\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: Restoring platform NVS memory$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: Saving platform NVS memory$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: suspend entry \(deep\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: suspend exit$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pnp 00:0[[:digit:]]: \[dma 0 disabled\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pnp 00:0[[:digit:]]: \[dma 2\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pnp 00:0[[:digit:]]: Plug and Play ACPI device, IDs( PNP[[:xdigit:]]+)+ \(active\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pnp: PnP ACPI: found [[:digit:]]+ devices$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pnp: PnP ACPI init$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Policy zone: DMA32$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Policy zone: Normal$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ppdev: user-space parallel port driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pps_core: LinuxPPS API ver. 1 registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pps pps[[:digit:]]: new PPS source ptp[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] prefetch64-sse : [[:digit:]]+ MB/sec$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] printk: console \[tty0\] enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] printk: console \[ttyS0\] enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] printk: Suspending console\(s\) \(use no_console_suspend to debug\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? Process accounting resumed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] process: using AMD E400 aware idle routine$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] process: using mwait in idle threads$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] process '/usr/bin/fstype' started with executable stack$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PTP clock support registered$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PV qspinlock hash table entries: 256 \(order: 0, 4096 bytes, linear\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 0000:0[[:digit:]]:00\.0 [[:alnum:]]+: jumbo features \[frames: [[:digit:]]+ bytes, tx checksumming: ko\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 0000:0[[:digit:]]:00\.0 [[:alnum:]]+: RTL8168[[:alpha:]]+/8111[[:alpha:]]+, [[:xdigit:]:]+, XID [[:xdigit:]]+, IRQ [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 [[:digit:]:.]+ [[:alnum:]]+: Link is Down$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 [[:digit:]:.]+ [[:alnum:]]+: Link is Up - 1Gbps/Full - flow control (off|rx/tx)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: fence driver on ring 0 use gpu addr 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: GTT: 512M 0x[[:xdigit:]]+ - 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: radeon: MSI limited to 32-bit$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: radeon: using MSI\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: VRAM: 128M 0x[[:xdigit:]]+ - 0x[[:xdigit:]]+ \(128M used\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: WB enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: avx2x[[:digit:]] gen\(\) [[:digit:][:space:]]+ MB/s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: avx2x[[:digit:]] xor\(\) [[:digit:][:space:]]+ MB/s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: sse2x[[:digit:]] gen\(\) [[:digit:][:space:]]+ MB/s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: sse2x[[:digit:]] xor\(\) [[:digit:][:space:]]+ MB/s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm avx2x2 gen\(\) [[:digit:][:space:]]+ MB/s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm avx2x4 gen\(\) [[:digit:][:space:]]+ MB/s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm sse2x2 gen\(\) [[:digit:][:space:]]+ MB/s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm sse2x2 gen\(\) [[:digit:][:space:]]+ MB/s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using avx2x2 recovery algorithm$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using ssse3x2 recovery algorithm$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: \.\.\.\. xor\(\) [[:digit:]]+ MB/s, rmw enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAMDISK: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: chronyc: uninitialized urandom read \(4096 bytes read\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: crng init done$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: dd: uninitialized urandom read \(32 bytes read\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: ln: uninitialized urandom read \(6 bytes read\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: lvm: uninitialized urandom read \([[:digit:]]+ bytes read\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: mktemp: uninitialized urandom read \(8 bytes read\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: API unit is 2\^-32 Joules, [[:digit:]] fixed counters, [[:digit:]]+ ms ovfl timer$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain dram 2\^-14 Joules$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain package 2\^-14 Joules$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain pp0-core 2\^-14 Joules$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain pp1-gpu 2\^-14 Joules$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: Hierarchical RCU implementation\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: Hierarchical SRCU implementation\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: RCU restricting CPUs from NR_CPUS=8192 to nr_cpu_ids=[[:digit:]]\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] registered taskstats version 1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? Rekeying PTK for STA [[:xdigit:]:]+ but driver can't safely do that\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Reserving Intel graphics memory at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Restarting tasks \.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Restarting tasks \.\.\. done\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered named UNIX socket transport module\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered tcp NFSv4\.1 backchannel transport module\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered tcp transport module\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered udp transport module\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: alarms up to one (day|month),( y3k,)? [[:digit:]]+ bytes nvram, hpet irqs$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: registered as rtc0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: RTC can wake from S4$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: setting system clock to [[:digit:]T:-]+ UTC \([[:digit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RTL8211[[:alpha:]] Gigabit Ethernet r8169-0-200:00: attached PHY driver \[RTL8211[[:alpha:]] Gigabit Ethernet\] \(mii_bus:phy_addr=r8169-0-200:00, irq=IGNORE\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Run /init as init process$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Scanning NUMA topology in Northbridge 24$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sched_clock: Marking stable \([[:digit:]]+, [[:digit:]]+\)->\([[:digit:]]+, -[[:digit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] scsi host[[:digit:]]: ahci$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] scsi host[[:digit:]]: ata_piix$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] scsi host[[:digit:]]: pata_atiixp$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] 4096-byte physical blocks$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Attached SCSI disk$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] [[:digit:]]+ 512-byte logical blocks: \([[:digit:].]+ [TG]B/[[:digit:].]+ [TG]iB\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] (Stopping|Starting) disk$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Synchronizing SCSI cache$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Write Protect is off$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sdhci: Copyright\(c\) Pierre Ossman$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sdhci-pci 0000:00:[[:digit:].]+: SDHCI controller found \[1022:7813\] \(rev 1\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sdhci: Secure Digital Host Controller Interface driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Segment Routing with IPv6$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] serial8250: ttyS[[:digit:]] at I/O 0x[[:xdigit:]]+ \(irq = [[:digit:]], base_baud = 115200\) is a 16550A$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] serio: i8042 (KBD|AUX) port at 0x60,0x64 irq [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] setup_percpu: NR_CPUS:8192 nr_cpumask_bits:[[:digit:]] nr_cpu_ids:[[:digit:]] nr_node_ids:1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=[[:digit:]], Nodes=1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] SMBIOS [[:digit:].]+ present\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: Allowing [[:digit:]]+ CPUs, 0 hotplug CPUs$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: Booting Node 0 Processor [[:digit:]] APIC 0x[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: CPU0: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: CPU [[:digit:]]+ is now offline$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: Max logical packages: 1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: Total of [[:digit:]]+ processors activated \([[:digit:].]+ BogoMIPS\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smp: Bringing up secondary CPUs \.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smp: Brought up 1 node, [[:digit:]] CPUs$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] software IO TLB: mapped \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] \(64MB\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sp5100_tco: SP5100/SB800 TCO WatchDog Timer Driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sp5100-tco sp5100-tco: initialized. heartbeat=60 sec \(nowayout=0\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sp5100-tco sp5100-tco: Using 0xfeb00000 for watchdog MMIO address$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sr 4:0:0:0: Attached scsi CD-ROM sr0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sr 4:0:0:0: \[sr0\] scsi3-mmc drive: 204x/204x writer dvd-ram cd/rw xa/form2 cdda tray$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sr 4:0:0:0: \[sr0\] scsi3-mmc drive: 306x/306x writer dvd-ram cd/rw xa/form2 cdda tray$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] SSE version of gcm_enc/dec engaged.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] SVM: kvm: Nested Paging disabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] SVM: kvm: Nested Paging enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Switched APIC routing to cluster x2apic.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Switched APIC routing to physical x2apic.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] has been reserved$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: \[io 0x[[:xdigit:]]+\] has been reserved$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] could not be reserved$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] has been reserved$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: Plug and Play ACPI device, IDs INT[[:xdigit:]]+ PNP[[:xdigit:]]+ \(active\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: Plug and Play ACPI device, IDs PNP[[:xdigit:]]+ \(active\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TCP (bind|established) hash table entries: [[:digit:]]+ \(order: [[:digit:]], [[:digit:]]+ bytes, linear\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TCP: Hash tables configured \(established [[:digit:]]+ bind [[:digit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] tcp_listen_portaddr_hash hash table entries: [[:digit:]]+ \(order: [[:digit:]]+, [[:digit:]]+ bytes, linear\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TERM=linux$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal LNXTHERM:[[:digit:]]+: registered as thermal_zone[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal_sys: Registered thermal governor 'bang_bang'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal_sys: Registered thermal governor 'fair_share'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal_sys: Registered thermal governor 'power_allocator'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal_sys: Registered thermal governor 'step_wise'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal_sys: Registered thermal governor 'user_space'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.TIMER: vector=0x30 apic1=0 pin1=2 apic2=-?[[:digit:]] pin2=-?[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TOM[[:digit:]]?: [[:xdigit:]]+ aka [[:digit:]]+M$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TOMOYO Linux initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] "trace_clock=local"$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Tracing|Rude) variant of Tasks RCU enabled\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Trying to unpack rootfs image as initramfs\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TSC deadline timer available$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] tsc: Detected [[:digit:].]+ MHz (TSC|processor)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] tsc: Fast TSC calibration using PIT$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] tsc: Refined TSC clocksource calibration: [[:digit:].]+ MHz$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[TTM\] Initializing DMA pool allocator$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[TTM\] Initializing pool allocator$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[TTM\] Zone kernel: Available graphics memory: [[:digit:]]+ KiB$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] UDF-fs: INFO Mounting volume '.*', timestamp [[:digit:]/]+ [[:digit:]:]+ \(1000\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] UDP(-Lite)? hash table entries: [[:digit:]]+ \(order: [[:digit:]], [[:digit:]]+ bytes, linear\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usbcore: registered new device driver usb$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb [[:digit:]]-[[:digit:]]: Manufacturer: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb [[:digit:]]-[[:digit:]]: new (full|high)-speed USB device number [[:digit:]] using (xhci_hcd|ehci-pci)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb [[:digit:]]-[[:digit:]]: New USB device found, idVendor=[[:xdigit:]]+, idProduct=[[:xdigit:]]+, bcdDevice= [[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb [[:digit:]]-[[:digit:]]: New USB device strings: Mfr=[[:digit:]], Product=[[:digit:]], SerialNumber=0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb [[:digit:]]-[[:digit:]]: Product: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usbhid: USB HID core driver$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: Manufacturer: Linux .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: New USB device found, idVendor=[[:xdigit:]]+, idProduct=[[:xdigit:]]+, bcdDevice= 5.10$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: New USB device strings: Mfr=3, Product=2, SerialNumber=1$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: Product: EHCI Host Controller$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: Product: OHCI PCI host controller$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: Product: xHCI Host Controller$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: SerialNumber: [[:xdigit:]:.-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Using ACPI \(MADT\) for SMP configuration information$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Using GB pages for direct mapping$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. value mask: 0000ffffffffffff$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. version: [[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] VFS: Disk quotas dquot_6.6.0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] VFS: Dquot-cache hash table entries: 512 \(order 0, 4096 bytes\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] vgaarb: loaded$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] virtio_blk virtio1: [vda] 41910272 512-byte logical blocks \(21.5 GB/20.0 GiB\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] with arguments:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] with environment:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] workingset: timestamp_bits=36 max_order=[[:digit:]]+ bucket_order=0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Write protecting the kernel read-only data: 22528k$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x2apic enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x2apic: IRQ remapping doesn't support X2APIC mode$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86: Booting SMP configuration:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/cpu: User Mode Instruction Prevention (UMIP) activated$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: Enabled xstate features 0x3, context size is 576 bytes, using 'compacted' format.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: x87 FPU will use FXSAVE$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: xstate_offset\[2\]: 576, xstate_sizes\[2\]: 256$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/mm: Checked W\+X mappings: passed, no W\+X pages found\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/mm: Checking user space page tables$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/mm: Memory block size: 128MB$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/PAT: Configuration \[0-7\]: WB WC UC- UC WB WP UC- WT$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:xdigit:]]+-[[:xdigit:]]+ (uncachable|write-back|write-protect)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xhci_hcd [[:xdigit:]:.]+: hcc params 0x[[:xdigit:]]+ hci version 0x[[:xdigit:]]+ quirks 0x[[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xhci_hcd [[:xdigit:]:.]+: Host supports USB 3.0 SuperSpeed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xhci_hcd [[:xdigit:]:.]+: Host supports USB 3.1 Enhanced SuperSpeed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xhci_hcd [[:xdigit:]:.]+: new USB bus registered, assigned bus number [[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xhci_hcd [[:xdigit:]:.]+: xHCI Host Controller$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xor: automatically using best checksumming function avx$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xor: measuring software checksum speed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xor: using function: prefetch64-sse \([[:digit:]]+ MB/sec\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] zbud: loaded$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Zone ranges:$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] zswap: loaded using pool lzo/zbud$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] USB Video Class driver \(1\.1\.1\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] lp: driver loaded but no devices found$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i2c /dev entries driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Asymmetric key parser 'pkcs8' registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] loop: module loaded$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EXT4-fs \([[:alnum:]-]+\): mounted filesystem with ordered data mode\. Opts: acl$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EXT4-fs \([[:alnum:]-]+\): re-mounted\. Opts: acl,errors=remount-ro$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: Core ver 2\.22$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: HCI device and connection manager initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: HCI socket layer initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: L2CAP socket layer initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: SCO socket layer initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM: chip id 63$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM: features 0x07$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM20702A$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM20702A1 \(001\.002\.014\) build 0000$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: BNEP \(Ethernet Emulation\) ver 1\.3$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: BNEP filters: protocol multicast$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: BNEP socket layer initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Initializing XFRM netlink socket
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] 00:0[[:digit:]]: ttyS[[:digit:]] at I/O 0x[[:digit:]]f8 \(irq = [[:digit:]], base_baud = 115200\) is a 16550A$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] 8021q: 802.1Q VLAN Support v1.8$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] 8021q: adding VLAN 0 to HW filter on device [[:alnum:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Added _OSI.*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: (APIC|DBG2|DBGP|DMAR|DSDT|FACP|FACS|FIDT|FPDT|HEST|HPET|IVRS|LPIT|MCFG|OEMB|RSDP|RSDT|SSDT|TPM2|UEFI|XSDT)( 0x[[:xdigit:]]+ [[:xdigit:]]+( \(v[[:digit:]]+ .*\))?)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: TCPA 0x[[:xdigit:]]+ 000032 \(v02 COREv4 COREBOOT 00000000 CORE 20200110\)
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: bus type PCI registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: bus type USB registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Core revision [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpi_cpufreq: overriding BIOS provided _PSD data$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: [[:digit:]] ACPI AML tables successfully acquired and loaded$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: duty_cycle spans bit 4$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Dynamic OEM Table Load:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Early table checksum verification disabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Enabled [[:digit:]]+ GPEs in block [[:xdigit:]]+ to [[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI FADT declares the system doesn't support PCIe ASPM, so disable it$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: HPET id: 0x[[:xdigit:]]+ base: 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Interpreter enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: INT_SRC_OVR \(bus 0 bus_irq [[:digit:]]+ global_irq [[:digit:]]+ dfl dfl\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: INT_SRC_OVR \(bus 0 bus_irq [[:digit:]]+ global_irq [[:digit:]]+ high level\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: INT_SRC_OVR \(bus 0 bus_irq [[:digit:]]+ global_irq [[:digit:]]+ low level\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: IRQ[[:digit:]]+ used by override\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: LAPIC_NMI \(acpi_id\[0x[[:xdigit:]]+\] dfl dfl lint\[0x1\]\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: LAPIC_NMI \(acpi_id\[0x[[:xdigit:]]+\] high edge lint\[0x1\]\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Local APIC address 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Low-level resume complete$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: PCI Interrupt Link \[(INT|LNK)[[:alpha:]]\] \(IRQs [[:digit:][:space:]*]+\)( [[:digit:]*]+)?(, disabled\.)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: PCI Root Bridge \[PCI0\] \(domain 0000 \[bus 00-[[:xdigit:]]+\]\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpiphp: Slot \[[[:digit:]]+\] registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: PM-Timer IO Port: 0x[[:xdigit:]]+V?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpi PNP0A0[[:digit:]]:00: _OSC: OS supports \[ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpi PNP0A0[[:digit:]]:00: _OSC: OS now controls \[PCIeHotplug SHPCHotplug PME AER PCIeCapability LTR\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Power Button \[PWRB\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Power Button \[PWRF\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Power Resource \[(FN[[:digit:]]+|PG[[:digit:]]+|WRST|FPWR)\] \((off|on)\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: \\_PR_\.CPU0: _OSC native thermal LVT Acked$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Preparing to enter system sleep state S3$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: \\_PR_\.P[[:digit:]]+: Found 2 idle states$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Reserving (APIC|ASF!|DBG2|DBGP|DMAR|DSDT|FACP|FACS|FIDT|FPDT|HEST|HPET|IVRS|LPIT|MCFG|OEMB|SSDT|TCPA|TPM2|UEFI) table memory at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Sleep Button \[SLPB\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: \(supports( S[[:digit:]])+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Thermal Zone \[TZ[[:digit:]]+\] \([[:digit:]]+ C\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Using IOAPIC for interrupt routing$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Video Device \[GFX0\] \(multi-head: yes rom: no post: no\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Waking up from system sleep state S3$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Adding [[:digit:]]+k swap on [^.]+\. Priority:-2 extents:1 across:[[:digit:]]+k (SS)?FS$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AES CTR mode by8 optimization enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AGP: Checking aperture\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AGP: No AGP bridge found$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AGP: Node 0: aperture \[bus addr 0x28e6000000-0x28e7ffffff\] \(32MB\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ahci 0000:00:[[:xdigit:]]+.[[:digit:]]: AHCI 0001.[[:digit:]]+ 32 slots [[:digit:]] ports [[:digit:]] Gbps 0x[[:xdigit:]]+ impl SATA mode$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ahci 0000:00:[[:xdigit:]]+.[[:digit:]]: flags: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ahci 0000:00:[[:xdigit:]]+.[[:digit:]]: version 3.0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]_]+ 0000:0[[:digit:]]:[[:xdigit:]]{2}\.[[:xdigit:]] [[:alnum:]]+: renamed from [[:alnum:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: associate with [[:xdigit:]:]+ \(try [[:digit:]]/3\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: authenticate with [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: authenticate with [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: authentication with [[:xdigit:]:]+ timed out$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: deauthenticated from [[:xdigit:]:]+ \(Reason: 3=DEAUTH_LEAVING\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+ filesystem being mounted at /[[:alnum:]]+ supports timestamps until 2038 \(0x[[:xdigit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:].]+: port [[:digit:]]+\([[:alnum:].]+\) entered (disabled|blocking|forwarding) state$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:alnum:]]+: send auth to [[:xdigit:]:+ \(try [[:digit:]]/3\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AMD64 EDAC driver v3.5.0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] amd_uncore: 4 amd_l2 counters detected$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] amd_uncore: 4 amd_nb counters detected$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Aperture beyond 4GB\. Ignoring\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] APIC: Switch to symmetric I/O mode setup$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AppArmor: AppArmor Filesystem Enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AppArmor: AppArmor initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AppArmor: AppArmor sha1 policy hashing enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Asymmetric key parser 'x509' registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] async_tx: api initialized \(async\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] at24 0-[[:digit:]]+: 256 byte spd EEPROM, read-only$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] at24 0-[[:digit:]]+: supply vcc not found, using dummy regulator$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata1.00: SB600 AHCI: limiting to 255 sectors per cmd$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: applying PMP SRST workaround and retrying$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:].]+: configured for UDMA/[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]].[[:digit:]]+: ATA-[[:digit:]]+: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]].[[:digit:]]+: ATAPI: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]].[[:digit:]]+: [[:digit:]]+ sectors, multi [[:digit:]]+: LBA48( NCQ \(depth 32\), AA)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:].]+: disabling queued TRIM support$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: DUMMY$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:].]+: Enabling discard_zeroes_data$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: PATA max MWDMA2 cmd 0x[[:xdigit:]]+ ctl 0x376 bmdma 0x[[:xdigit:]]+ irq [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: PATA max UDMA/100 cmd 0x[[:xdigit:]]+ ctl 0x3f6 bmdma 0xff00 irq [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: SATA link down \(SStatus 0 SControl 300\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: SATA link up [[:digit:].]+ Gbps \(SStatus [[:digit:]]+ SControl 300\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: SATA max UDMA/133 abar m[[:digit:]]+@0x[[:xdigit:]]+ port 0x[[:xdigit:]]+ irq [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:]]: softreset failed \(device not ready\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata[[:digit:].]+: supports DRM functions and may not be fully accessible$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ata_piix 0000:00:01.1: version 2.13$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: Country alpha2 being used: US$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: country maps to regdmn code: 0x3a$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: doing EEPROM country->regdmn map search$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: EEPROM indicates default country code should be used$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: EEPROM regdomain: 0x0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ath: Regpair used: 0x3a$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ATOM BIOS: ATI$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] audit: type=1400 audit\([[:digit:].:]+\): apparmor="STATUS" operation="profile_load" profile="unconfined" .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AVX2 version of gcm_enc/dec engaged.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AVX version of gcm_enc/dec engaged.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] ACPI data$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] ACPI NVS$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] reserved$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] usable$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] type 16$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-provided physical RAM map:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. bit width: 48$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Block layer SCSI generic \(bsg\) driver version 0.4 loaded \(major [[:digit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BOOT_IMAGE=/vmlinuz-.*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Booting paravirtualized kernel on bare hardware$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Booting paravirtualized kernel on KVM$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Built 1 zonelists, mobility grouping on. Total pages: [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] bus: 00 \[io 0x0000-0xffff\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] bus: 00 \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] bus: \[bus 00-ff\] on node 0 link 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Calibrating delay loop \(skipped\) preset value.. [[:digit:].]+ BogoMIPS \(lpj=[[:digit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Calibrating delay loop \(skipped\), value calculated using timer frequency.. [[:digit:].]+ BogoMIPS \(lpj=[[:digit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] caller pci_map_rom\+0x[[:xdigit:]]+/0x[[:xdigit:]]+ mapping multiple BARs$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ccp 0000:00:[[:xdigit:]]+.0: ccp enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ccp 0000:00:[[:xdigit:]]+.0: [[:digit:]] command queues available$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cdrom: Uniform CD-ROM driver Revision: 3.20$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cfg80211: Loaded X.509 cert .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cfg80211: Loading compiled-in X.509 certificates for regulatory database$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] clocksource: (acpi_pm|hpet|jiffies|kvm-clock|refined-jiffies|tsc-early|tsc): mask: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] clocksource: Switched to clocksource (acpi_pm|hpet|jiffies|kvm-clock|refined-jiffies|tsc-early|tsc)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Command line: BOOT_IMAGE=.*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Console: colour dummy device 80x25$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Console: colour VGA\+ 80x25$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Console: switching to colour dummy device 80x25$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Console: switching to colour frame buffer device 240x75$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] CPU[[:digit:]] is up$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cpuidle: using governor (ladder|menu)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cryptd: max_cpu_qlen set to 1000$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] dca service started, version 1.12.1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Dentry cache hash table entries: [[:digit:]]+ \(order: [[:digit:]]+, [[:digit:]]+ bytes, linear\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Detected use of extended apic ids on hypertransport bus$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? device [[:alnum:].]+ (entered|left) promiscuous mode$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Device empty$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] device-mapper: ioctl: 4.43.0-ioctl \(2020-10-01\) initialised: dm-devel@redhat.com$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] device-mapper: uevent: version 1.0.3$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] devtmpfs: initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ( #[[:digit:]])+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:digit:]] base [[:xdigit:]]+ mask [[:xdigit:]]+ (uncachable|write-back|write-protect|write-combining)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:digit:]] disabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Disabling|Enabling) non-boot CPUs \.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMA: preallocated [[:digit:]]+ KiB GFP_KERNEL(\|GFP_DMA(32)?)? pool for atomic allocations$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: dmar[[:digit:]]: reg_base_addr [[:xdigit:]]+ ver 1:0 cap [[:xdigit:]]+ ecap [[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: dmar[[:digit:]]: Using Queued invalidation$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: DRHD base: 0x[[:xdigit:]]+ flags: 0x[[:xdigit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: Host address width [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: Intel\(R\) Virtualization Technology for Directed I/O$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR-IR: Enabled IRQ remapping in x2apic mode$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR-IR: HPET id 0 under DRHD base 0xfed91000$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR-IR: IOAPIC id [[:digit:]]+ under DRHD base 0xfed91000 IOMMU 1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR-IR: Queued invalidation will be enabled to support x2apic and Intr-remapping\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: No ATSR found$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: RMRR base: 0x[[:xdigit:]]+ end: 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: LENOVO 2325CT4/2325CT4, BIOS CBET4000 4.12-375-g7729b29a58 05/28/2020$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: MICRO-STAR INTERANTIONAL CO\.,LTD MS-7368/MS-7368, BIOS V1\.5B2 10/31/2007$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: PC Engines apu2/apu2, BIOS v4\.11\.0\.1 12/09/2019$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: System manufacturer System Product Name/P8H67-M PRO, BIOS 9005 09/18/2018$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: MSI MS-7816/H87-G43 \(MS-7816\), BIOS V2\.14B15 05/20/2019$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] done\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Connector [[:digit:]]:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] CRT1: INTERNAL_KLDSCP_DAC1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] DDC: 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+ 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Detected VRAM RAM=128M, BAR=128M$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] DFP3: INTERNAL_LVTM1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Encoders:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] GART: num cpu pages 131072, num gpu pages 131072$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] HDMI-A-1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Initialized i915 1.6.0 20200917 for 0000:00:02.0 on minor 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Initialized radeon 2.50.0 20080528 for 0000:01:05.0 on minor 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] initializing kernel modesetting \(RS690 0x1002:0x791E 0x1462:0x7327 0x00\)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Loading RS690/RS740 Microcode$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] PCIE GART of 512M enabled \(table at 0x[[:xdigit:]]+\)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon: 128M of VRAM memory ready$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon: 1 quad pipes, 1 z pipes initialized\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon: 512M of GTT memory ready.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon: cp finalized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Radeon Display Connectors$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon: irq initialized.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] radeon kernel modesetting enabled.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] RAM width 128bits DDR$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] SVIDEO-1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] TV1: INTERNAL_KLDSCP_DAC1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] VGA-1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6 0000:00:1f\.6 \(uninitialized\): registered PHC clock$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6 [[:alnum:]]+: Intel\(R\) PRO/1000 Network Connection$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6 [[:alnum:]]+: MAC: 12, PHY: 12, PBA No: FFFFFF-0FF$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6 [[:alnum:]]+: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6 [[:alnum:]]+: \(PCI Express:2.5GT/s:Width x1\) [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e 0000:00:1f\.6: Interrupt Throttling Rate \(ints/sec\) set to dynamic conservative mode$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e: Copyright\(c\) 1999 - 2015 Intel Corporation\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e1000e: Intel\(R\) PRO/1000 Network Driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e820: remove \[mem 0x000a0000-0x000fffff\] usable$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e820: reserve RAM buffer \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] e820: update \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] usable ==> reserved$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Early memory node ranges$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: F16h_M30h detected \(node 0\)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: K8 revF or later detected \(node 0\)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: MC: [[:digit:]]: [[:digit:][:space:]]+MB [[:digit:]]: 0MB$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: MCT channel count: 1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: Node 0: DRAM ECC disabled.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: Node 0: DRAM ECC enabled.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC amd64: using x4 syndromes.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC MC0: Giving out device to module amd64_edac controller F16h_M30h: DEV 0000:00:18.3 \(INTERRUPT\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC MC: DCT[[:digit:]] chip selects:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC MC: Ver: 3.0.0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EDAC PCI0: Giving out device to module amd64_edac controller EDAC PCI controller: DEV 0000:00:18.2 \(POLLED\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ee1004 0-[[:digit:]]+: 512 byte EE1004-compliant SPD EEPROM, read-only$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci_hcd: USB 2.0 'Enhanced' Host Controller \(EHCI\) Driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: applying AMD SB600/SB700 USB freeze workaround$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: debug port [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: EHCI Host Controller$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: irq [[:digit:]]+, io mem 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: new USB bus registered, assigned bus number [[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci 0000:00:[[:xdigit:]]+\.[[:digit:]]: USB 2.0 started, EHCI 1.00$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ehci-pci: EHCI PCI platform driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. event mask: [[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] f71882fg f71882fg.1536: Fan: [[:digit:]] is in duty-cycle mode$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] f71882fg: Found f71882fg chip at 0x600, revision 32$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] fbcon: i915drmfb \(fb0\) is primary device$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Filesystems sync: [[:digit:].]+ seconds$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. fixed-purpose events: [[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] found SMP MP-table at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing initrd memory: [[:digit:]]+K$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing SMP alternatives memory: [[:digit:]]+K?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing unused decrypted memory: [[:digit:]]+K$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing unused kernel image \(initmem\) memory: [[:digit:]]+K$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing unused kernel image \(rodata/data gap\) memory: [[:digit:]]+K$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freeing unused kernel image \(text/rodata gap\) memory: [[:digit:]]+K$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freezing remaining freezable tasks \.\.\. \(elapsed [[:digit:].]+ seconds\) done\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Freezing user space processes \.\.\. \(elapsed [[:digit:].]+ seconds\) done\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] FS-Cache: Loaded$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] FS-Cache: Netfs 'nfs' registered for caching$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ftrace: allocated [[:digit:]]+ pages with [[:digit:]]+ groups$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ftrace: allocating [[:digit:]]+ entries in [[:digit:]]+ pages$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] fuse: init \(API version 7.32\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] futex hash table entries: [[:digit:]]+ \(order: [[:digit:]]+, [[:digit:]]+ bytes, linear\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. generic registers: [[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] generic_sse : [[:digit:]]+ MB/sec$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] HEST: Table parsing has been initialized\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hid-generic 0003:0B05:189D.0001: No inputs registered, leaving$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hid: raw HID events driver \(C\) Jiri Kosina$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] HOME=/$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hpet0: at MMIO 0xfed00000, IRQs [[:digit:][:space:],]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hpet0: [[:digit:]] comparators, (64|32)-bit [[:digit:].]+ MHz counter$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hub [[:digit:]]-[[:digit:]]:1.0: [[:digit:]]+ ports detected$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] hub [[:digit:]]-[[:digit:]]:1.0: USB hub found$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] HugeTLB registered [[:digit:]]+.00 [MG]iB page size, pre-allocated 0 pages$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Hypervisor detected: KVM$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i2c i2c-0: [[:digit:]]/4 memory slots populated \(from DMI\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i2c i2c-0: Successfully instantiated SPD at 0x5[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i801_smbus 0000:00:1f\.[[:digit:]]: enabling device \(0001 -> 0003\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i801_smbus 0000:00:1f\.[[:digit:]]: SMBus using PCI interrupt$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i801_smbus 0000:00:1f\.[[:digit:]]: SPD Write Disable is set$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i8042: No controller found$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i8042: PNP: No PS/2 controller found\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i8042: PNP: PS/2 Controller \[PNP0303:KBD,PNP0f13:MOU\] at 0x60,0x64 irq 1,12$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i8042: PNP: PS/2 Controller \[PNP0303:PS2K\] at 0x60,0x64 irq 1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i8042: Probing ports directly\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i915 0000:00:02\.0: \[drm\] DMAR active, disabling use of stolen memory$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i915 0000:00:02\.0: \[drm\] DMC firmware homepage: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i915 0000:00:02\.0: \[drm\] fb0: i915drmfb frame buffer device$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i915 0000:00:02\.0: \[drm\] VT-d active for gfx access$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i915 0000:00:02\.0: vgaarb: changed VGA decodes: olddecodes=io\+mem,decodes=io\+mem:owns=io\+mem$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (i915|radeon) 0000:0[[:digit:]]:0[[:digit:]]\.0: vgaarb: deactivate vga console$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ieee80211 phy0: Atheros AR9280 Rev:2 mem=0x[[:xdigit:]]+, irq=58$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0: added PHC on eth[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0 [[:alnum:]]+: igb: [[:alnum:]]+ NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX(/TX)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0: [[:alnum:]]+: PBA No: FFFFFF-0FF$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0: [[:alnum:]]+: \(PCIe:2.5Gb/s:Width x1\) [[:xdigit:]:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0: Intel\(R\) Gigabit Ethernet Network Connection$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb 0000:0[[:digit:]]:00\.0: Using MSI-X interrupts. 4 rx queue\(s\), 4 tx queue\(s\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb: Copyright \(c\) 2007-2014 Intel Corporation\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] igb: Intel\(R\) Gigabit Ethernet Network Driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] /init$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Initialise system trusted keyrings$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Initmem setup node 0 \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Inode-cache hash table entries: [[:digit:]]+ \(order: [[:digit:]]+, [[:digit:]]+ bytes, linear\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA ATI HDMI HDMI/DP,pcm=3 as /devices/pci0000:00/0000:00:01.0/0000:01:05.2/sound/card0/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH Front Headphone as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH Front Mic as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH HDMI/DP,pcm=[[:digit:]]+ as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input1[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH Line as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH Line Out as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: HDA Intel PCH Rear Mic as /devices/pci0000:00/0000:00:1f.3/sound/card[[:digit:]]/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: PC Speaker as /devices/platform/pcspkr/input/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: Power Button as /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0C:00/input/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: PRP0001:00 as /devices/pci0000:00/PRP0001:00/input/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: Sleep Button as /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0E:00/input/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] input: Video Bus as /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/LNXVIDEO:00/input/input[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Installing knfsd \(copyright \(C\) 1996 okir@monad\.swb\.de\)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] integrity: Platform Keyring initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_idle: Local APIC timer is reliable in all C-states$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_idle: MWAIT substates: 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_idle: v0.5.1 model 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_pmc_core INT33A1:00: initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_pstate: CPU model not supported$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_pstate: HWP enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_pstate: Intel P-state driver initializing$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_rapl_common: Found RAPL domain core$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_rapl_common: Found RAPL domain dram$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_rapl_common: Found RAPL domain package$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] intel_rapl_common: Found RAPL domain uncore$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] IOAPIC\[[[:digit:]]\]: apic_id [[:digit:]]+, version [[:digit:]]+, address 0x[[:xdigit:]]+, GSI [[:digit:]]+-[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iommu: Default domain type: Translated$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] io scheduler mq-deadline registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] IP idents hash table entries: [[:digit:]]+ \(order: [[:digit:]]+, [[:digit:]]+ bytes, linear\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] IPI shorthand broadcast: enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] IPv6: ADDRCONF\(NETDEV_CHANGE\): [[:alnum:]]+: link becomes ready$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] IRQ [[:digit:]]+: no longer affine to CPU[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iTCO_vendor_support: vendor-support=0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iTCO_wdt: Found a Intel PCH TCO device \(Version=4, TCOBASE=0x0400\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iTCO_wdt: Found a Lynx Point TCO device \(Version=2, TCOBASE=0x1860\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iTCO_wdt: initialized. heartbeat=30 sec \(nowayout=0\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iTCO_wdt: Intel TCO WatchDog Timer Driver v1.11$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] iwlwifi [[:xdigit:]:]+: Radio type=[[:xdigit:]x-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kauditd_printk_skb: [[:digit:]]+ callbacks suppressed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Kernel command line: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Kernel/User page tables isolation: enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Key type asymmetric registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Key type blacklist registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Key type fscrypt-provisioning registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Key type ._fscrypt registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Key type .fscrypt registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Kprobes globally optimized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-clock: cpu [[:digit:]], msr [[:xdigit:]]+, (primary|secondary) cpu clock$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-clock: Using msrs [[:xdigit:]]+ and [[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-clock: using sched offset of [[:digit:]]+ cycles$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-guest: KVM setup pv remote TLB flush$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-guest: PV spinlocks enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-guest: setup PV IPIs$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-guest: stealtime: cpu [[:digit:]], msr [[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm: Nested Virtualization enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Last level (dTLB|iTLB) entries: 4KB [[:digit:]]+, 2MB [[:digit:]]+, 4MB [[:digit:]]+, 1GB [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] last_pfn = 0x[[:xdigit:]]+ max_arch_pfn = 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ledtrig-cpu: registered to indicate activity on CPUs$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Linux agpgart interface v0.103$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Linux version .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Loaded X.509 cert '.*'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Loading compiled-in X.509 certificates$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] LSM: Security Framework initializing$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] LVT offset [[:digit:]] assigned for vector 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. max period: [[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mce: CPU0: Thermal monitoring enabled \(TM1\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] MCE: In-kernel MCE decoding enabled.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mc: Linux media interface: v0.10$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] md[[:digit:]]+: detected capacity change from 0 to [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] md/raid1:md[[:digit:]]+: active with 2 out of 2 mirrors$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mei_me 0000:00:16.0: enabling device \(0000 -> 0002\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] available for PCI devices$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mem auto-init: stack:off, heap alloc:on, heap free:off$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Memory: [[:digit:]]+K/[[:digit:]]+K available \([[:digit:]]+K kernel code, [[:digit:]]+K rwdata, [[:digit:]]+K rodata, [[:digit:]]+K init, [[:digit:]]+K bss, [[:digit:]]+K reserved, 0K cma-reserved\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] microcode: CPU[[:digit:]]: patch_level=0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] microcode: microcode updated early to revision 0x[[:xdigit:]]+, date = [[:digit:]-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] microcode: Microcode Update Driver: v2.2\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] microcode: sig=0x[[:xdigit:]]+, pf=0x[[:xdigit:]]+, revision=0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mip6: Mobile IPv6$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Mountpoint-cache|Mount-cache) hash table entries: [[:digit:]]+ \(order: [[:digit:]], [[:digit:]]+ bytes, linear\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mousedev: PS/2 mouse device common for all mice$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Movable zone start for each node$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mpls_gso: MPLS GSO support$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mtrr: corrected configuration.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] MTRR default type: uncachable$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] MTRR default type: write-back$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] MTRR fixed ranges enabled:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] MTRR variable ranges enabled:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] nct6775: Found NCT6779D or compatible chip at 0x4e:0xa00$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NetLabel: domain hash size = 128$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NetLabel: Initializing$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NetLabel: unlabeled traffic allowed by default$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] nfsd: last server has exited, flushing export cache$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NFSD: starting 90-second grace period \(net [[:xdigit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NFSD: Using UMH upcall client tracking operations\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NMI watchdog: Enabled\. Permanently consumes one hw-PMU counter\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\.\. node #0, CPUs:.*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] node 0 deferred pages initialised in [[:digit:]]+ms$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] node 0 link 0: io port \[[[:xdigit:]]+, [[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] node 0 link 0: mmio \[[[:xdigit:]]+, [[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] node 0: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NODE_DATA\(0\) allocated \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] No NUMA configuration found$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Normal|DMA(32)?)[[:space:]]+\[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Normal|DMA(32)?) zone: [[:digit:]]+ pages, LIFO batch:[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Normal|DMA(32)?) zone: [[:digit:]]+ pages reserved$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Normal|DMA(32)?) zone: [[:digit:]]+ pages used for memmap$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Normal empty$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NR_IRQS: 524544, nr_irqs: [[:digit:]]+, preallocated irqs: [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] NX \(Execute Disable\) protection: active$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ohci_hcd: USB 1.1 'Open' Host Controller \(OHCI\) Driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ohci-pci 0000:00:13.[[:digit:]]: irq [[:digit:]]+, io mem 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ohci-pci 0000:00:13.[[:digit:]]: new USB bus registered, assigned bus number [[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ohci-pci 0000:00:13.[[:digit:]]: OHCI PCI host controller$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ohci-pci: OHCI PCI platform driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] On node 0 totalpages: [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] On node 0, zone (DMA(32)?|Normal): [[:digit:]]+ pages in unavailable ranges$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] on the kernel command line$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] OOM killer (enabled|disabled)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] parport0: PC-style at 0x378, irq 5 \[PCSPP\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] parport0: PC-style at 0x378, irq 5 \[PCSPP,TRISTATE,EPP\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] parport_pc 00:0[[:digit:]]: reported by Plug and Play ACPI$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (parport_pc|serial) [[:digit:]:]+: (activated|disabled)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:00\.0: disabling ASPM on pre-1\.1 PCIe device\. You can enable it with 'pcie_aspm=force'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Activating ISA DMA hang workarounds$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Adding to iommu group [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: BAR [[:digit:]]+: assigned \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: BAR [[:digit:]]+: assigned \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: BAR [[:digit:]]+: assigned \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ 64bit pref\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: BAR [[:digit:]]+: assigned \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ pref\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] to \[bus 01\] add_size 1000$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+ window\] \(subtractive decode\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ 64bit pref\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ 64bit pref\] to \[bus 01\] add_size 200000 add_align 100000$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] to \[bus 01\] add_size 200000 add_align 100000$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: bridge window \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ window\] \(subtractive decode\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Disabling ASPM L0s/L1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: enabling Extended Tags$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Enabling MPC IRBNCE$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Intel PCH root port ACS workaround enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: legacy IDE quirk: reg 0x[[:xdigit:]]+: \[io 0x[[:xdigit:]]+(-0x[[:xdigit:]]+)?\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Limiting direct PCI/PCI transfers$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI host bridge to bus 0000:00$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: PCI bridge to \[bus [[:digit:]-]+\]( \(subtractive decode\))?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: PIIX3: Enabling Passive Release$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: PME# supported from .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ 64bit\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ 64bit pref\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+ pref\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: supports [[:alnum:][:space:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: vgaarb: bridge control possible$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: vgaarb: setting as boot VGA device$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: vgaarb: VGA device added: decodes=io\+mem,owns=io\+mem,locks=none$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Video device with shadowed ROM at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: \[[[:xdigit:]]+:[[:xdigit:]]+\] type [[:digit:]]+ class 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:[[:xdigit:]]{2}:[[:xdigit:]]{2}\.[[:xdigit:]]: PCI bridge to \[bus [[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[bus 00-[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+( window)?\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+( window| 64bit| pref)*\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:[[:xdigit:]]+: Allocating resources$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: CLS [[:digit:]]+ bytes, default 64$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI-DMA: Using software bounce buffering for IO \(SWIOTLB\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:].]+: (AER|PME): enabled with IRQ [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:]]+\.[[:digit:]]: Enabling MPC IRBNCE$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:]]+\.[[:digit:]]: Intel PCH root port ACS workaround enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:].]+: pciehp: Slot #0 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug\+ Surprise\+ Interlock- NoCompl\+ IbPresDis- LLActRep\+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:].]+: PME: Signaling with IRQ [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI Interrupt Link \[LNK[CD]\] enabled at IRQ [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: MMCONFIG at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] reserved in ACPI motherboard resources$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: MMCONFIG at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] reserved in E820$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: MMCONFIG for domain 0000 \[bus 00-[[:xdigit:]]+\] at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] \(base 0x[[:xdigit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: pci_cache_line_size set to 64 bytes$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: Using ACPI for IRQ routing$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: Using configuration type 1 for base access$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcpu-alloc: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] percpu: Embedded [[:digit:]]+ pages/cpu .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] perf: AMD IBS detected \(0x000000ff\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] perf: interrupt took too long ([[:digit:]]+ > [[:digit:]]+), lowering kernel.perf_event_max_sample_rate to [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Performance Events: AMD PMU driver\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Performance Events: Haswell events, full-width counters, Intel PMU driver\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Performance Events: PEBS fmt[[:digit:]]\+, [[:alpha:]]+ events, [[:digit:]]+-deep LBR, full-width counters, Intel PMU driver\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pid_max: default: 32768 minimum: 301$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] piix4_smbus 0000:00:14.0: Auxiliary SMBus Host Controller at 0xb20$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] piix4_smbus 0000:00:14.0: SMBus Host Controller at 0xb00, revision 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] piix4_smbus 0000:00:14.0: Using register 0x02 for SMBus port selection$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pinctrl core: initialized pinctrl subsystem$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] platform regulatory.0: firmware: direct-loading firmware regulatory.db$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] platform regulatory.0: firmware: direct-loading firmware regulatory.db.p7s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: hibernation: Registered nosave memory: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: Registering ACPI NVS region \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] \([[:digit:]]+ bytes\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: Restoring platform NVS memory$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: Saving platform NVS memory$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: suspend entry \(deep\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PM: suspend exit$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pnp 00:0[[:digit:]]: \[dma 0 disabled\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pnp 00:0[[:digit:]]: \[dma 2\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pnp 00:0[[:digit:]]: Plug and Play ACPI device, IDs( PNP[[:xdigit:]]+)+ \(active\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pnp: PnP ACPI: found [[:digit:]]+ devices$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pnp: PnP ACPI init$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Policy zone: DMA32$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Policy zone: Normal$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ppdev: user-space parallel port driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pps_core: LinuxPPS API ver. 1 registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pps pps[[:digit:]]: new PPS source ptp[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] prefetch64-sse : [[:digit:]]+ MB/sec$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] printk: console \[tty0\] enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] printk: console \[ttyS0\] enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] printk: Suspending console\(s\) \(use no_console_suspend to debug\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? Process accounting resumed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] process: using AMD E400 aware idle routine$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] process: using mwait in idle threads$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] process '/usr/bin/fstype' started with executable stack$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PTP clock support registered$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PV qspinlock hash table entries: 256 \(order: 0, 4096 bytes, linear\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 0000:0[[:digit:]]:00\.0 [[:alnum:]]+: jumbo features \[frames: [[:digit:]]+ bytes, tx checksumming: ko\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 0000:0[[:digit:]]:00\.0 [[:alnum:]]+: RTL8168[[:alpha:]]+/8111[[:alpha:]]+, [[:xdigit:]:]+, XID [[:xdigit:]]+, IRQ [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 [[:digit:]:.]+ [[:alnum:]]+: Link is Down$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 [[:digit:]:.]+ [[:alnum:]]+: Link is Up - 1Gbps/Full - flow control (off|rx/tx)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: fence driver on ring 0 use gpu addr 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: GTT: 512M 0x[[:xdigit:]]+ - 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: radeon: MSI limited to 32-bit$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: radeon: using MSI\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: VRAM: 128M 0x[[:xdigit:]]+ - 0x[[:xdigit:]]+ \(128M used\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: WB enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: avx2x[[:digit:]] gen\(\) [[:digit:][:space:]]+ MB/s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: avx2x[[:digit:]] xor\(\) [[:digit:][:space:]]+ MB/s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: sse2x[[:digit:]] gen\(\) [[:digit:][:space:]]+ MB/s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: sse2x[[:digit:]] xor\(\) [[:digit:][:space:]]+ MB/s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm avx2x2 gen\(\) [[:digit:][:space:]]+ MB/s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm avx2x4 gen\(\) [[:digit:][:space:]]+ MB/s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm sse2x2 gen\(\) [[:digit:][:space:]]+ MB/s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm sse2x2 gen\(\) [[:digit:][:space:]]+ MB/s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using avx2x2 recovery algorithm$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using ssse3x2 recovery algorithm$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: \.\.\.\. xor\(\) [[:digit:]]+ MB/s, rmw enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAMDISK: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: chronyc: uninitialized urandom read \(4096 bytes read\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: crng init done$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: dd: uninitialized urandom read \(32 bytes read\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: ln: uninitialized urandom read \(6 bytes read\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: lvm: uninitialized urandom read \([[:digit:]]+ bytes read\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: mktemp: uninitialized urandom read \(8 bytes read\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: API unit is 2\^-32 Joules, [[:digit:]] fixed counters, [[:digit:]]+ ms ovfl timer$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain dram 2\^-14 Joules$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain package 2\^-14 Joules$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain pp0-core 2\^-14 Joules$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain pp1-gpu 2\^-14 Joules$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: Hierarchical RCU implementation\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: Hierarchical SRCU implementation\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: RCU restricting CPUs from NR_CPUS=8192 to nr_cpu_ids=[[:digit:]]\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] registered taskstats version 1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? Rekeying PTK for STA [[:xdigit:]:]+ but driver can't safely do that\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Reserving Intel graphics memory at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Restarting tasks \.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Restarting tasks \.\.\. done\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered named UNIX socket transport module\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered tcp NFSv4\.1 backchannel transport module\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered tcp transport module\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered udp transport module\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: alarms up to one (day|month),( y3k,)? [[:digit:]]+ bytes nvram, hpet irqs$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: registered as rtc0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: RTC can wake from S4$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: setting system clock to [[:digit:]T:-]+ UTC \([[:digit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RTL8211[[:alpha:]] Gigabit Ethernet r8169-0-200:00: attached PHY driver \[RTL8211[[:alpha:]] Gigabit Ethernet\] \(mii_bus:phy_addr=r8169-0-200:00, irq=IGNORE\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Run /init as init process$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Scanning NUMA topology in Northbridge 24$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sched_clock: Marking stable \([[:digit:]]+, [[:digit:]]+\)->\([[:digit:]]+, -[[:digit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] scsi host[[:digit:]]: ahci$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] scsi host[[:digit:]]: ata_piix$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] scsi host[[:digit:]]: pata_atiixp$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] 4096-byte physical blocks$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Attached SCSI disk$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] [[:digit:]]+ 512-byte logical blocks: \([[:digit:].]+ [TG]B/[[:digit:].]+ [TG]iB\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] (Stopping|Starting) disk$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Synchronizing SCSI cache$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Write Protect is off$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sdhci: Copyright\(c\) Pierre Ossman$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sdhci-pci 0000:00:[[:digit:].]+: SDHCI controller found \[1022:7813\] \(rev 1\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sdhci: Secure Digital Host Controller Interface driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Segment Routing with IPv6$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] serial8250: ttyS[[:digit:]] at I/O 0x[[:xdigit:]]+ \(irq = [[:digit:]], base_baud = 115200\) is a 16550A$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] serio: i8042 (KBD|AUX) port at 0x60,0x64 irq [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] setup_percpu: NR_CPUS:8192 nr_cpumask_bits:[[:digit:]] nr_cpu_ids:[[:digit:]] nr_node_ids:1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=[[:digit:]], Nodes=1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] SMBIOS [[:digit:].]+ present\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: Allowing [[:digit:]]+ CPUs, 0 hotplug CPUs$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: Booting Node 0 Processor [[:digit:]] APIC 0x[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: CPU0: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: CPU [[:digit:]]+ is now offline$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: Max logical packages: 1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smpboot: Total of [[:digit:]]+ processors activated \([[:digit:].]+ BogoMIPS\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smp: Bringing up secondary CPUs \.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] smp: Brought up 1 node, [[:digit:]] CPUs$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] software IO TLB: mapped \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] \(64MB\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sp5100_tco: SP5100/SB800 TCO WatchDog Timer Driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sp5100-tco sp5100-tco: initialized. heartbeat=60 sec \(nowayout=0\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sp5100-tco sp5100-tco: Using 0xfeb00000 for watchdog MMIO address$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sr 4:0:0:0: Attached scsi CD-ROM sr0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sr 4:0:0:0: \[sr0\] scsi3-mmc drive: 204x/204x writer dvd-ram cd/rw xa/form2 cdda tray$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sr 4:0:0:0: \[sr0\] scsi3-mmc drive: 306x/306x writer dvd-ram cd/rw xa/form2 cdda tray$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] SSE version of gcm_enc/dec engaged.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] SVM: kvm: Nested Paging disabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] SVM: kvm: Nested Paging enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Switched APIC routing to cluster x2apic.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Switched APIC routing to physical x2apic.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: \[io 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] has been reserved$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: \[io 0x[[:xdigit:]]+\] has been reserved$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] could not be reserved$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] has been reserved$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: Plug and Play ACPI device, IDs INT[[:xdigit:]]+ PNP[[:xdigit:]]+ \(active\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] system 00:[[:digit:]]+: Plug and Play ACPI device, IDs PNP[[:xdigit:]]+ \(active\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TCP (bind|established) hash table entries: [[:digit:]]+ \(order: [[:digit:]], [[:digit:]]+ bytes, linear\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TCP: Hash tables configured \(established [[:digit:]]+ bind [[:digit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] tcp_listen_portaddr_hash hash table entries: [[:digit:]]+ \(order: [[:digit:]]+, [[:digit:]]+ bytes, linear\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TERM=linux$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal LNXTHERM:[[:digit:]]+: registered as thermal_zone[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal_sys: Registered thermal governor 'bang_bang'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal_sys: Registered thermal governor 'fair_share'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal_sys: Registered thermal governor 'power_allocator'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal_sys: Registered thermal governor 'step_wise'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] thermal_sys: Registered thermal governor 'user_space'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.TIMER: vector=0x30 apic1=0 pin1=2 apic2=-?[[:digit:]] pin2=-?[[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TOM[[:digit:]]?: [[:xdigit:]]+ aka [[:digit:]]+M$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TOMOYO Linux initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] "trace_clock=local"$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Tracing|Rude) variant of Tasks RCU enabled\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Trying to unpack rootfs image as initramfs\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] TSC deadline timer available$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] tsc: Detected [[:digit:].]+ MHz (TSC|processor)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] tsc: Fast TSC calibration using PIT$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] tsc: Refined TSC clocksource calibration: [[:digit:].]+ MHz$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[TTM\] Initializing DMA pool allocator$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[TTM\] Initializing pool allocator$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[TTM\] Zone kernel: Available graphics memory: [[:digit:]]+ KiB$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] UDF-fs: INFO Mounting volume '.*', timestamp [[:digit:]/]+ [[:digit:]:]+ \(1000\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] UDP(-Lite)? hash table entries: [[:digit:]]+ \(order: [[:digit:]], [[:digit:]]+ bytes, linear\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usbcore: registered new device driver usb$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb [[:digit:]]-[[:digit:]]: Manufacturer: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb [[:digit:]]-[[:digit:]]: new (full|high)-speed USB device number [[:digit:]] using (xhci_hcd|ehci-pci)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb [[:digit:]]-[[:digit:]]: New USB device found, idVendor=[[:xdigit:]]+, idProduct=[[:xdigit:]]+, bcdDevice= [[:digit:].]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb [[:digit:]]-[[:digit:]]: New USB device strings: Mfr=[[:digit:]], Product=[[:digit:]], SerialNumber=0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb [[:digit:]]-[[:digit:]]: Product: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usbhid: USB HID core driver$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: Manufacturer: Linux .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: New USB device found, idVendor=[[:xdigit:]]+, idProduct=[[:xdigit:]]+, bcdDevice= 5.10$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: New USB device strings: Mfr=3, Product=2, SerialNumber=1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: Product: EHCI Host Controller$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: Product: OHCI PCI host controller$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: Product: xHCI Host Controller$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] usb usb[[:digit:]]+: SerialNumber: [[:xdigit:]:.-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Using ACPI \(MADT\) for SMP configuration information$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Using GB pages for direct mapping$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. value mask: 0000ffffffffffff$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. version: [[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] VFS: Disk quotas dquot_6.6.0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] VFS: Dquot-cache hash table entries: 512 \(order 0, 4096 bytes\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] vgaarb: loaded$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] virtio_blk virtio1: [vda] 41910272 512-byte logical blocks \(21.5 GB/20.0 GiB\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] with arguments:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] with environment:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] workingset: timestamp_bits=36 max_order=[[:digit:]]+ bucket_order=0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Write protecting the kernel read-only data: 22528k$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x2apic enabled$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x2apic: IRQ remapping doesn't support X2APIC mode$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86: Booting SMP configuration:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/cpu: User Mode Instruction Prevention (UMIP) activated$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: Enabled xstate features 0x3, context size is 576 bytes, using 'compacted' format.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: x87 FPU will use FXSAVE$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/fpu: xstate_offset\[2\]: 576, xstate_sizes\[2\]: 256$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/mm: Checked W\+X mappings: passed, no W\+X pages found\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/mm: Checking user space page tables$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/mm: Memory block size: 128MB$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] x86/PAT: Configuration \[0-7\]: WB WC UC- UC WB WP UC- WT$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] [[:xdigit:]]+-[[:xdigit:]]+ (uncachable|write-back|write-protect)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xhci_hcd [[:xdigit:]:.]+: hcc params 0x[[:xdigit:]]+ hci version 0x[[:xdigit:]]+ quirks 0x[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xhci_hcd [[:xdigit:]:.]+: Host supports USB 3.0 SuperSpeed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xhci_hcd [[:xdigit:]:.]+: Host supports USB 3.1 Enhanced SuperSpeed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xhci_hcd [[:xdigit:]:.]+: new USB bus registered, assigned bus number [[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xhci_hcd [[:xdigit:]:.]+: xHCI Host Controller$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xor: automatically using best checksumming function avx$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xor: measuring software checksum speed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] xor: using function: prefetch64-sse \([[:digit:]]+ MB/sec\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] zbud: loaded$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Zone ranges:$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] zswap: loaded using pool lzo/zbud$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ lvm\[[[:digit:]]+\]: [[:digit:]]+ logical volume\(s\) in volume group "[[:alnum:]-]+" monitored$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ lvm\[[[:digit:]]+\]: pvscan\[[[:digit:]]+\] PV [^[:space:]]+ online, VG [[:alnum:]-]+ is complete\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ lvm\[[[:digit:]]+\]: pvscan\[[[:digit:]]+\] VG [[:alnum:]-]+ skip autoactivation\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ lvm\[[[:digit:]]+\]: [[:digit:]]+ logical volume\(s\) in volume group "[[:alnum:]-]+" monitored$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ lvm\[[[:digit:]]+\]: pvscan\[[[:digit:]]+\] PV [^[:space:]]+ online, VG [[:alnum:]-]+ is complete\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ lvm\[[[:digit:]]+\]: pvscan\[[[:digit:]]+\] VG [[:alnum:]-]+ skip autoactivation\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ minissdpd\[[[:digit:]]+\]: [[:digit:]]+ new devices added$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ minissdpd\[[[:digit:]]+\]: [[:digit:]]+ devices removed (good-bye!)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ minissdpd\[[[:digit:]]+\]: [[:digit:]]+ new devices added$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ minissdpd\[[[:digit:]]+\]: [[:digit:]]+ devices removed (good-bye!)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] Bruteforce attack: IN=[[:alnum:].]+ OUT= MAC=[[:xdigit:]:]+ SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP|132|4) SPT=[[:digit:]]+ DPT=[[:digit:]]+ (WINDOW=[[:digit:]]+ RES=0x[[:digit:]]+ (CWR )?(ECE )?(SYN|ACK|RST)+ (PSH )?(FIN )?URGP=[[:digit:]]+|LEN=[[:digit:]]+)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] Blackholing: IN=[[:alnum:].]+ OUT= MAC=[[:xdigit:]:]+ SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP|132|4) SPT=[[:digit:]]+ DPT=[[:digit:]]+ (WINDOW=[[:digit:]]+ RES=0x[[:digit:]]+ (CWR )?(ECE )?(SYN|ACK|RST) (PSH )?(FIN )?URGP=[[:digit:]]+|LEN=[[:digit:]]+)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] Illegal incoming traffic: IN=[[:alnum:].]+ OUT= MAC=[[:xdigit:]:]* SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP|132|4) SPT=[[:digit:]]+ DPT=[[:digit:]]+ (WINDOW=[[:digit:]]+ RES=0x[[:xdigit:]]+ (CWR )?(ECE )?(URG )?(SYN|ACK|RST)+ (PSH )?(FIN )?URGP=[[:digit:]]+|LEN=[[:digit:]]+)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] Illegal forwarding traffic: IN=[[:alnum:].]+ OUT=[[:alnum:].-]+ MACSRC=[[:xdigit:]:]* MACDST=[[:xdigit:]:]* MACPROTO=[[:xdigit:]:]* SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP|132|4) SPT=[[:digit:]]+ DPT=[[:digit:]]+( SEQ=[[:digit:]]+ ACK=[[:digit:]]+)? (WINDOW=[[:digit:]]+ RES=0x[[:xdigit:]]+ (CWR )?(ECE )?(URG )?(SYN|ACK|RST) (PSH )?(FIN )?URGP=[[:digit:]]+|LEN=[[:digit:]]+)( OPT \([[:xdigit:]]+\))?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] Illegal forwarding traffic: IN=[[:alnum:].]+ OUT=[[:alnum:].-]+ MACSRC=[[:xdigit:]:]* MACDST=[[:xdigit:]:]* MACPROTO=[[:xdigit:]:]* SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=ICMPv6 TYPE=128 CODE=0 ID=[[:digit:]]+ SEQ=[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] Bruteforce attack: IN=[[:alnum:].]+ OUT= MAC=[[:xdigit:]:]+ SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP|132|4) SPT=[[:digit:]]+ DPT=[[:digit:]]+ (WINDOW=[[:digit:]]+ RES=0x[[:digit:]]+ (CWR )?(ECE )?(SYN|ACK|RST)+ (PSH )?(FIN )?URGP=[[:digit:]]+|LEN=[[:digit:]]+)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] Blackholing: IN=[[:alnum:].]+ OUT= MAC=[[:xdigit:]:]+ SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP|132|4) SPT=[[:digit:]]+ DPT=[[:digit:]]+ (WINDOW=[[:digit:]]+ RES=0x[[:digit:]]+ (CWR )?(ECE )?(SYN|ACK|RST) (PSH )?(FIN )?URGP=[[:digit:]]+|LEN=[[:digit:]]+)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] Illegal incoming traffic: IN=[[:alnum:].]+ OUT= MAC=[[:xdigit:]:]* SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP|132|4) SPT=[[:digit:]]+ DPT=[[:digit:]]+ (WINDOW=[[:digit:]]+ RES=0x[[:xdigit:]]+ (CWR )?(ECE )?(URG )?(SYN|ACK|RST)+ (PSH )?(FIN )?URGP=[[:digit:]]+|LEN=[[:digit:]]+)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] Illegal forwarding traffic: IN=[[:alnum:].]+ OUT=[[:alnum:].-]+ MACSRC=[[:xdigit:]:]* MACDST=[[:xdigit:]:]* MACPROTO=[[:xdigit:]:]* SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=(TCP|UDP|132|4) SPT=[[:digit:]]+ DPT=[[:digit:]]+( SEQ=[[:digit:]]+ ACK=[[:digit:]]+)? (WINDOW=[[:digit:]]+ RES=0x[[:xdigit:]]+ (CWR )?(ECE )?(URG )?(SYN|ACK|RST) (PSH )?(FIN )?URGP=[[:digit:]]+|LEN=[[:digit:]]+)( OPT \([[:xdigit:]]+\))?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ kernel: \[[[:digit:][:space:].]+\] Illegal forwarding traffic: IN=[[:alnum:].]+ OUT=[[:alnum:].-]+ MACSRC=[[:xdigit:]:]* MACDST=[[:xdigit:]:]* MACPROTO=[[:xdigit:]:]* SRC=[[:xdigit:]:.]+ DST=[[:xdigit:]:.]+ LEN=[[:digit:]]+ (TC=[[:digit:]]+ HOPLIMIT=[[:digit:]]+ FLOWLBL=[[:digit:]]+|TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+) (DF )?PROTO=ICMPv6 TYPE=128 CODE=0 ID=[[:digit:]]+ SEQ=[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: axfr for [[:alnum:].-]+ from [[:xdigit:].:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: axfr for [[:alnum:].-]+ from [[:xdigit:].:]+ refused, no acl matches$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: failed reading from [[:xdigit:].:]+ tcp: Connection reset by peer$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: Handle incoming notify for zone [[:alnum:].-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: memory recyclebin holds [[:digit:]] bytes$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: notify for [[:alnum:].-]+ from [[:xdigit:].:]+ refused, no acl matches\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: notify for [[:alnum:].-]+ from [[:xdigit:].:]+ serial [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: Notify received and accepted, forward to xfrd$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: nsd started \(NSD [[:digit:].]+\), pid [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: nsd starting \(NSD [[:digit:].]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: NSTATS [[:digit:]]+ [[:digit:]]+ (A=[[:digit:]]+ )?(NS=[[:digit:]]+ )?(CNAME=[[:digit:]]+ )?(SOA=[[:digit:]]+ )?(PTR=[[:digit:]]+ )?(MX=[[:digit:]]+ )?(TXT=[[:digit:]]+ )?(AAAA=[[:digit:]]+ )?(SRV=[[:digit:]]+ )?(NAPTR=[[:digit:]]+ )?(TYPE38=[[:digit:]]+ )?(NSEC=[[:digit:]]+ )?(DNSKEY=[[:digit:]]+ )?(SPF=[[:digit:]]+ )?(TYPE251=[[:digit:]]+ )?(TYPE252=[[:digit:]]+ )?TYPE255=[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: packet too small, dropping tcp connection$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: setup SSL certificates$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: signal received, reloading\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: writing zone [[:alnum:].-]+ to file [[:alnum:]/.-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: xfrd: zone [[:alnum:].-]+ committed "received update to serial [[:digit:]]+ at [[:digit:]T:-]+ from [[:xdigit:].:]+"$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: xfrd: zone [[:alnum:].-]+ written received XFR from [[:digit:].]+ with serial [[:digit:]]+ to disk$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: XSTATS [[:digit:]]+ [[:digit:]]+ RR=[[:digit:]]+ RNXD=[[:digit:]]+ RFwdR=[[:digit:]]+ RDupR=[[:digit:]]+ RFail=[[:digit:]]+ RFErr=[[:digit:]]+ RErr=[[:digit:]]+ RAXFR=[[:digit:]]+ RLame=[[:digit:]]+ ROpts=[[:digit:]]+ SSysQ=[[:digit:]]+ SAns=[[:digit:]]+ SFwdQ=[[:digit:]]+ SDupQ=[[:digit:]]+ SErr=[[:digit:]]+ RQ=[[:digit:]]+ RIQ=[[:digit:]]+ RFwdQ=[[:digit:]]+ RDupQ=[[:digit:]]+ RTCP=[[:digit:]]+ SFwdR=[[:digit:]]+ SFail=[[:digit:]]+ SFErr=[[:digit:]]+ SNaAns=[[:digit:]]+ SNXD=[[:digit:]]+ RUQ=[[:digit:]]+ RURQ=[[:digit:]]+ RUXFR=[[:digit:]]+ RUUpd=[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: zone [[:alnum:]_.-]+ read with success$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: zone [[:alnum:].-]+\. received update to serial [[:digit:]]+ at [[:digit:]T:-]+ from [[:xdigit:].:]+ of [[:digit:]]+ bytes in [[:digit:]e.-]+ seconds$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: [Zz]one [[:alnum:].-]+ serial [[:digit:]]+ is updated to [[:digit:]]+\.?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: axfr for [[:alnum:].-]+ from [[:xdigit:].:]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: axfr for [[:alnum:].-]+ from [[:xdigit:].:]+ refused, no acl matches$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: failed reading from [[:xdigit:].:]+ tcp: Connection reset by peer$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: Handle incoming notify for zone [[:alnum:].-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: memory recyclebin holds [[:digit:]] bytes$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: notify for [[:alnum:].-]+ from [[:xdigit:].:]+ refused, no acl matches\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: notify for [[:alnum:].-]+ from [[:xdigit:].:]+ serial [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: Notify received and accepted, forward to xfrd$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: nsd started \(NSD [[:digit:].]+\), pid [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: nsd starting \(NSD [[:digit:].]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: NSTATS [[:digit:]]+ [[:digit:]]+ (A=[[:digit:]]+ )?(NS=[[:digit:]]+ )?(CNAME=[[:digit:]]+ )?(SOA=[[:digit:]]+ )?(PTR=[[:digit:]]+ )?(MX=[[:digit:]]+ )?(TXT=[[:digit:]]+ )?(AAAA=[[:digit:]]+ )?(SRV=[[:digit:]]+ )?(NAPTR=[[:digit:]]+ )?(TYPE38=[[:digit:]]+ )?(NSEC=[[:digit:]]+ )?(DNSKEY=[[:digit:]]+ )?(SPF=[[:digit:]]+ )?(TYPE251=[[:digit:]]+ )?(TYPE252=[[:digit:]]+ )?TYPE255=[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: packet too small, dropping tcp connection$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: setup SSL certificates$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: signal received, reloading\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: writing zone [[:alnum:].-]+ to file [[:alnum:]/.-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: xfrd: zone [[:alnum:].-]+ committed "received update to serial [[:digit:]]+ at [[:digit:]T:-]+ from [[:xdigit:].:]+"$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: xfrd: zone [[:alnum:].-]+ written received XFR from [[:digit:].]+ with serial [[:digit:]]+ to disk$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: XSTATS [[:digit:]]+ [[:digit:]]+ RR=[[:digit:]]+ RNXD=[[:digit:]]+ RFwdR=[[:digit:]]+ RDupR=[[:digit:]]+ RFail=[[:digit:]]+ RFErr=[[:digit:]]+ RErr=[[:digit:]]+ RAXFR=[[:digit:]]+ RLame=[[:digit:]]+ ROpts=[[:digit:]]+ SSysQ=[[:digit:]]+ SAns=[[:digit:]]+ SFwdQ=[[:digit:]]+ SDupQ=[[:digit:]]+ SErr=[[:digit:]]+ RQ=[[:digit:]]+ RIQ=[[:digit:]]+ RFwdQ=[[:digit:]]+ RDupQ=[[:digit:]]+ RTCP=[[:digit:]]+ SFwdR=[[:digit:]]+ SFail=[[:digit:]]+ SFErr=[[:digit:]]+ SNaAns=[[:digit:]]+ SNXD=[[:digit:]]+ RUQ=[[:digit:]]+ RURQ=[[:digit:]]+ RUXFR=[[:digit:]]+ RUUpd=[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: zone [[:alnum:]_.-]+ read with success$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: zone [[:alnum:].-]+\. received update to serial [[:digit:]]+ at [[:digit:]T:-]+ from [[:xdigit:].:]+ of [[:digit:]]+ bytes in [[:digit:]e.-]+ seconds$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ nsd\[[[:digit:]]+\]: [Zz]one [[:alnum:].-]+ serial [[:digit:]]+ is updated to [[:digit:]]+\.?$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: time reset [+-]*[0-9]{1,2}\.[0-9]{6} s$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronisation lost$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: no servers reachable$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronized to ([0-9.]{7,15}|[0-9a-fA-F:.]{4,39}), stratum [0-9]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronized to LOCAL\([0-9]+\), stratum [0-9]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: kernel time sync (disabled|enabled|status change) [0-9]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: precision = [0-9]+\.[0-9]+ usec$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: peer ([.0-9]{7,15}|[0-9a-fA-F:.]{4,39}) now (in)?valid$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: adjusting local clock by -?[.0-9]+s$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: adjust time server -?[.0-9]+ offset$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ntpd\[[0-9]+\]: time reset [+-]*[0-9]{1,2}\.[0-9]{6} s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronisation lost$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ntpd\[[0-9]+\]: no servers reachable$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronized to ([0-9.]{7,15}|[0-9a-fA-F:.]{4,39}), stratum [0-9]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronized to LOCAL\([0-9]+\), stratum [0-9]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ntpd\[[0-9]+\]: kernel time sync (disabled|enabled|status change) [0-9]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ntpd\[[0-9]+\]: precision = [0-9]+\.[0-9]+ usec$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ntpd\[[0-9]+\]: peer ([.0-9]{7,15}|[0-9a-fA-F:.]{4,39}) now (in)?valid$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ntpd\[[0-9]+\]: adjusting local clock by -?[.0-9]+s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ntpd\[[0-9]+\]: adjust time server -?[.0-9]+ offset$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ proftpd\[[[:digit:]]+\]: connect from [.:[:xdigit:]]+ \([.:[:xdigit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ proftpd\[[[:digit:]]+\]: connect from [.:[:xdigit:]]+ \([.:[:xdigit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ pumpd\[[[:digit:]]+\]: renewed lease for interface [[:alnum:]]+$
-
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ pumpd\[[[:digit:]]+\]: renewed lease for interface [[:alnum:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rpc\.mountd\[[[:digit:]]+\]: Version [[:digit:].]+ starting$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rpc\.mountd\[[[:digit:]]+\]: Caught signal 15, un-registering and exiting\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ rpc\.mountd\[[[:digit:]]+\]: Version [[:digit:].]+ starting$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ rpc\.mountd\[[[:digit:]]+\]: Caught signal 15, un-registering and exiting\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[[:digit:].]+" x-pid="[[:digit:]]+" x-info="https://www.rsyslog.com"\] rsyslogd was HUPed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[[:digit:].]+" x-pid="[[:digit:]]+" x-info="https://www.rsyslog.com"\] rsyslogd was HUPed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ saned\[[[:digit:]]+\]: bailing out, waiting for children\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ saned\[[[:digit:]]+\]: bail_out: all children exited$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ saned\[[[:digit:]]+\]: saned (AF-indep+IPv6) from sane-backends [^[:space:]]+ starting up$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ saned\[[[:digit:]]+\]: do_bindings: \[0\] bind failed: Address already in use$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ saned\[[[:digit:]]+\]: Now daemonized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ saned\[[[:digit:]]+\]: bailing out, waiting for children\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ saned\[[[:digit:]]+\]: bail_out: all children exited$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ saned\[[[:digit:]]+\]: saned (AF-indep+IPv6) from sane-backends [^[:space:]]+ starting up$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ saned\[[[:digit:]]+\]: do_bindings: \[0\] bind failed: Address already in use$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ saned\[[[:digit:]]+\]: Now daemonized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Configuration file /etc/smartd.conf was parsed, found DEVICESCAN, scanning devices$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Copyright \(C\) [[:digit:]-]+, .*, www\.smartmontools\.org$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Device: /dev/[[:alnum:]]+ \[SAT\], found in smartd database: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Device: /dev/[[:alnum:]]+ \[SAT\], [^,]+, S/N:[[:alnum:]]+,( WWN:[[:alnum:]-]+,)? FW:[[:alnum:].]+, [[:digit:].]+ [GT]B$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Device: /dev/[[:alnum:]]+, type changed from 'scsi' to 'sat'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Drive: DEVICESCAN, implied '-a' Directive on line 21 of file /etc/smartd.conf$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Monitoring [[:digit:]]+ ATA/SATA, [[:digit:]]+ SCSI/SAS and [[:digit:]]+ NVMe devices$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: smartd [[:digit:].]+ [[:digit:]-]+ r[[:digit:]]+ \[.*\] \(local build\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: smartd [[:digit:].-]+ r[[:digit:]]+ \[[[:alpha:]._-]+\] \(local build\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: smartd is exiting \(exit status 0\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: smartd received signal 15: Terminated$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Configuration file /etc/smartd.conf was parsed, found DEVICESCAN, scanning devices$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Copyright \(C\) [[:digit:]-]+, .*, www\.smartmontools\.org$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Device: /dev/[[:alnum:]]+ \[SAT\], found in smartd database: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Device: /dev/[[:alnum:]]+ \[SAT\], [^,]+, S/N:[[:alnum:]]+,( WWN:[[:alnum:]-]+,)? FW:[[:alnum:].]+, [[:digit:].]+ [GT]B$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Device: /dev/[[:alnum:]]+, type changed from 'scsi' to 'sat'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Drive: DEVICESCAN, implied '-a' Directive on line 21 of file /etc/smartd.conf$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Monitoring [[:digit:]]+ ATA/SATA, [[:digit:]]+ SCSI/SAS and [[:digit:]]+ NVMe devices$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: smartd [[:digit:].]+ [[:digit:]-]+ r[[:digit:]]+ \[.*\] \(local build\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: smartd [[:digit:].-]+ r[[:digit:]]+ \[[[:alpha:]._-]+\] \(local build\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: smartd is exiting \(exit status 0\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: smartd received signal 15: Terminated$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (spamd|check|re(port|voke))\[[[:digit:]]+\]:( spamd:)? connection from [._[:alnum:]-]+ \[[\.[:digit:]]+\]:[[:digit:]]+ to port [[:digit:]]+, fd [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (spamd|check|re(port|voke))\[[[:digit:]]+\]: (spamd: )?result: [.YN] [ [:digit:]-]+ - ([._[:alnum:],]+ )?scantime=[[:digit:].]+,size=[[:digit:]]+,(user=[^,]+,uid=[[:digit:]]+,required_score=[[:digit:].]+,rhost=[._[:alnum:]-]+,raddr=[[:digit:].]+,rport=[/[:alnum:].-]+,)?mid=(<[^[:space:]]+>|\(unknown\))(rmid=(<[^[:space:]]+>|\(unknown\)),)?,(bayes=[.[:digit:]]+(e-[[:digit:]]+)?,)?autolearn=(ham|spam|no|disabled|unavailable)(,shortcircuit=(ham|spam|no))?( autolearn_force=(no|yes))? *$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (spamd|check|re(port|voke))\[[[:digit:]]+\]: pyzor: \[[[:digit:]]+\] error: TERMINATED, signal 15 \(000f\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: util: setuid: ruid=[[:digit:]]+ euid=[[:digit:]]+ rgid=[[:digit:]]+ 8 45 108 egid=[[:digit:]]+ 8 45 108$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: dns: new_dns_packet: domain is utf8 flagged: [[:alnum:].-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: prefork: adjust: [0-2] idle children less than 1 minimum idle children\. Increasing spamd children: [[:digit:]]+ started\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: prefork: adjust: [3-5] idle children more than 2 maximum idle children\. Decreasing spamd children: [[:digit:]]+ killed\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: prefork: child states: II \[\.\.\. logline repeated [[:digit:]]+ times\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: handled cleanup of child pid \[[[:digit:]]+\] due to SIGCHLD: interrupted, signal 2 \(0002\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: dns: no callback for id [[:digit:]]+/[[:alnum:]]+/[[:alnum:]]+/[[:alnum:]._-]+, ignored, packet on next debug line$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: dns: no likely matching queries for id [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: server hit by SIGHUP, restarting$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: child \[[[:digit:]]+\] killed successfully: interrupted, signal 2 \(0002\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: child \[[[:digit:]]+\] killed successfully: interrupted, signal 2 \(0002\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: server socket closed, type IO::Socket::IP$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: server socket closed, type IO::Socket::IP$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: util: setuid: ruid=0 euid=0 rgid=0 0 egid=0 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: server started on IO::Socket::IP \[::1\]:783, IO::Socket::IP \[127.0.0.1\]:783 \(running version [[:digit:].]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd: spamd: restarting using '/usr/sbin/spamd --create-prefs --max-children [[:digit:]]+ --helper-home-dir -d --pidfile=/var/run/spamd.pid'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: internal error, python traceback seen in response$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ (spamd|check|re(port|voke))\[[[:digit:]]+\]:( spamd:)? connection from [._[:alnum:]-]+ \[[\.[:digit:]]+\]:[[:digit:]]+ to port [[:digit:]]+, fd [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ (spamd|check|re(port|voke))\[[[:digit:]]+\]: (spamd: )?result: [.YN] [ [:digit:]-]+ - ([._[:alnum:],]+ )?scantime=[[:digit:].]+,size=[[:digit:]]+,(user=[^,]+,uid=[[:digit:]]+,required_score=[[:digit:].]+,rhost=[._[:alnum:]-]+,raddr=[[:digit:].]+,rport=[/[:alnum:].-]+,)?mid=(<[^[:space:]]+>|\(unknown\))(rmid=(<[^[:space:]]+>|\(unknown\)),)?,(bayes=[.[:digit:]]+(e-[[:digit:]]+)?,)?autolearn=(ham|spam|no|disabled|unavailable)(,shortcircuit=(ham|spam|no))?( autolearn_force=(no|yes))? *$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ (spamd|check|re(port|voke))\[[[:digit:]]+\]: pyzor: \[[[:digit:]]+\] error: TERMINATED, signal 15 \(000f\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: util: setuid: ruid=[[:digit:]]+ euid=[[:digit:]]+ rgid=[[:digit:]]+ 8 45 108 egid=[[:digit:]]+ 8 45 108$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: dns: new_dns_packet: domain is utf8 flagged: [[:alnum:].-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: prefork: adjust: [0-2] idle children less than 1 minimum idle children\. Increasing spamd children: [[:digit:]]+ started\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: prefork: adjust: [3-5] idle children more than 2 maximum idle children\. Decreasing spamd children: [[:digit:]]+ killed\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: prefork: child states: II \[\.\.\. logline repeated [[:digit:]]+ times\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: handled cleanup of child pid \[[[:digit:]]+\] due to SIGCHLD: interrupted, signal 2 \(0002\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: dns: no callback for id [[:digit:]]+/[[:alnum:]]+/[[:alnum:]]+/[[:alnum:]._-]+, ignored, packet on next debug line$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: dns: no likely matching queries for id [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: server hit by SIGHUP, restarting$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: child \[[[:digit:]]+\] killed successfully: interrupted, signal 2 \(0002\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: child \[[[:digit:]]+\] killed successfully: interrupted, signal 2 \(0002\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: server socket closed, type IO::Socket::IP$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: server socket closed, type IO::Socket::IP$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: util: setuid: ruid=0 euid=0 rgid=0 0 egid=0 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: spamd: server started on IO::Socket::IP \[::1\]:783, IO::Socket::IP \[127.0.0.1\]:783 \(running version [[:digit:].]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd: spamd: restarting using '/usr/sbin/spamd --create-prefs --max-children [[:digit:]]+ --helper-home-dir -d --pidfile=/var/run/spamd.pid'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ spamd\[[[:digit:]]+\]: internal error, python traceback seen in response$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Accepted publickey for [^[:space:]]+ from [^[:space:]]+ port [[:digit:]]+ ssh2: (RSA-CERT ID [[:alnum:]]+@[[:alnum:]]+ \(serial [[:digit:]]+\) CA )?(RSA|ED25519) [:.[:xdigit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Bad packet length [[:digit:]]+\. \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Bad protocol version identification '[^']*' from [:.[:xdigit:]]+ port [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: banner exchange: Connection from [[:xdigit:].:]+ port [[:digit:]]+: could not read protocol version$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: banner exchange: Connection from [[:xdigit:].:]+ port [[:digit:]]+: invalid format$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: channel_by_id: 1: bad id: channel free$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: channel_input_success_failure: 1: unknown$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Connection (closed|reset) by (authenticating|invalid) user [[:alnum:][:punct:][:space:]]* [:.[:xdigit:]]+ port [[:digit:]]+ \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Connection (closed|reset) by [:.[:xdigit:]]+ port [[:digit:]]+( \[preauth\])?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Corrupted MAC on input\. \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Could not write ident string to UNKNOWN$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Did not receive identification string from ([:[:xdigit:].]+|UNKNOWN)+ port [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnected from (authenticating|invalid) user [[:alnum:][:punct:][:space:]]* [:[:xdigit:].]+ port [[:digit:]]+ \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnected from user [[:alnum:]]+ [:[:xdigit:].]+ port [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnected from [:[:xdigit:].]+ port [[:digit:]]+ \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting (authenticating|invalid) user [[:alnum:][:punct:]]* [:.[:xdigit:]]+ port [[:digit:]]+: Change of username or service not allowed: \([^,]*,ssh-connection\) -> \([^,]*,[^)]+\)? \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting (authenticating|invalid) user [[:alnum:][:punct:]]* [:.[:xdigit:]]+ port [[:digit:]]+: Too many authentication failures \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: bad client public DH value \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: Change of username or service not allowed: \([^,]*,ssh-connection\) -> \([^,]*,[^)]+\)? \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: Packet corrupt \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: Too many authentication failures for (invalid user|root) [[:alnum:]]+ from [[:digit:].]+ port [[:digit:]]+ ssh2 \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: Too many authentication failures \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: drop connection #[[:digit:]]+ from \[[:.[:xdigit:]]+\]:[[:digit:]]+ on \[[:.[:xdigit:]]+\]:[[:digit:]]+ past MaxStartups$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: Bad remote protocol version identification: 'SSH-2.0-?'$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: beginning MaxStartups throttling$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: connect_to .* port [[:digit:]]+: failed\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex_exchange_identification: banner line contains invalid characters$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex_exchange_identification: client sent invalid protocol identifier ".*"$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex_exchange_identification: Connection closed by remote host$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex_exchange_identification: Connection reset by peer$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex_exchange_identification: read: Connection reset by peer$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex protocol error: type 30 seq 1 \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: maximum authentication attempts exceeded for (invalid user [[:alnum:][:space:][:digit:]@\\!._-]*|root|sshd|mysql|ftp|nagios|postgres|redis) from [:.[:xdigit:]]+ port [[:digit:]]+ ssh2 \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: PAM: Authentication failure for( illegal user)? [^[:space:]]* from ([:.[:xdigit:]]+|UNKNOWN|[-_.[:alnum:]]+)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: PAM: service\(sshd\) ignoring max retries; [[:digit:]] > [[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: PAM: User not known to the underlying authentication module for illegal user [^[:space:]]* from [^[:space:]]*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Protocol major versions differ( for [[:xdigit:]:.]+ port [[:digit:]]+)?: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?10: user closed connection \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Bafta \\\\n \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: BUNNYBYTEv0.1 \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: BYE!BYE! \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: (Bye )?(Goodb|B)ye \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Client disconnecting normally \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Closed due to user request\. \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Cooling down ;\) \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: [Dd]isconnected by user \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Disconnected on user's request\. \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: disconnect \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: end \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: FlowSshPacketDecoder: unresponsiveness timeout \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Inchidere normala \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: JIHAD FROM BU. \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: logout \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Normal Shutdown(, Thank you for playing)? \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: ok \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Operation timeout \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: PECL\/ssh2 \(http:\/\/pecl\.php\.net\/packages\/ssh2\) \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: +\[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Shutdown(, Thanks for playing)? \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: [[:space:]]*\[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: These aren't the droids we're looking for\. \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?13: (Closed due to )?[Uu]ser request\.? \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?13: Unable to authenticate \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?14: no authentication methods available \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?14: No more user authentication methods available. \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?14: Unable to connect using the available authentication methods \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?2: Handshake failed \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: com\.jcraft\.jsch\.JSchException: Auth (cancel|fail) \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: com\.jcraft\.jsch\.JSchException: reject HostKey: [:.[:alnum:]]+ \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: com\.jcraft\.jsch\.JSchException: timeout in waiting for rekeying process\. \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: com\.jcraft\.jsch\.JSchException: UnknownHostKey: [[:xdigit:]:.]+\. RSA key fingerprint is [[:xdigit:]:.]+ \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: com\.jcraft\.jsch\.JSchException: verify: false \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: java\.net\.SocketTimeoutException: Read timed out \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: org\.vngx\.jsch\.userauth\.AuthCancelException: User authentication canceled by user \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: Tamir\.SharpSsh\.jsch\.JSchException: Auth fail\\\\r\\\\n \\\\320\\\\262 Tamir\.SharpSsh\.jsch\.Session\.connect\(Int32 connectTimeout\) \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?7: Service not available \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?7: User interaction is not allowed \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: send_error: write: Connection reset by peer$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: exited MaxStartups throttling after [[:digit:]:]+, [[:digit:]]+ connections dropped$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Failed (keyboard-interactive/pam|password|none) for (i(llegal|nvalid) user )?.* from ([:.[:xdigit:]]+|UNKNOWN|[-_.[:alnum:]]+) port [[:digit:]]{1,5} ssh2?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: no hostkey alg \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: no matching cipher found: client .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: no matching mac found: client .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Read from socket failed: Connection reset by peer \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Unable to negotiate a key exchange method \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: userauth_finish: (Connection reset by peer|Broken pipe) \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Write failed: (Connection reset by peer|Broken pipe) \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: input_userauth_request: invalid user [[:alnum:][:space:].:+-]+\[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: invalid public DH value: <= 1 \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Invalid user [[:alnum:][:space:][:digit:][:punct:]]* from [:.[:xdigit:]]+ port [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: packet_write_wait: Connection from authenticating user [[:alnum:][:space:][:digit:][:punct:]]* [:.[:xdigit:]]+ port [[:digit:]]+: Broken pipe \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: packet_write_wait: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: Broken pipe \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: PAM service\(sshd\) ignoring max retries; [[:digit:]] > [[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: pam_unix\(sshd:auth\): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=[^[:space:]]+([[:space:]]+user=(root|nobody|backup|daemon|www-data|games|news|mail|lp|sync|uucp|identd|gnats|irc|list|proxy|sys|nagios|mysql|bin|ftp|sshd|smmsp|snmp|man|ntp|quagga|libuuid|Debian-exim|proftpd|logcheck|vmail|statd|dovecot|postfix|puppet|bacula))?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: pam_unix\(sshd:auth\): bad username [[:alnum:][:space:][:digit:][:punct:]]*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: pam_unix\(sshd:auth\): check pass; user unknown
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Postponed (publickey|keyboard-interactive) for ([^[:space:]]+|invalid user)[[:space:]]+from [^[:space:]]+ port [[:digit:]]+ ssh2 \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received signal 15; terminating\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from (authenticating|invalid) user [[:alnum:][:space:][:digit:][:punct:]]* [:.[:xdigit:]]+ port [[:digit:]]+: message authentication code incorrect \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: bignum is negative \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: Broken pipe \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: Connection corrupted \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: DH GEX group out of range \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: incomplete message \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: message authentication code incorrect \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: invalid format \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Unable to negotiate with [:.[:xdigit:]]+ port [[:digit:]]+: no matching (cipher|key exchange method|host key type|MAC) found\. Their offer: .* \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: User [._[:alnum:]-]+ from [[:alnum:].-]+ not allowed because none of user's groups are listed in AllowGroups$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes \[preauth\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: warning: can't get client address: Connection reset by peer$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: WARNING: no suitable primes in /etc/ssh/moduli$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Accepted publickey for [^[:space:]]+ from [^[:space:]]+ port [[:digit:]]+ ssh2: (RSA-CERT ID [[:alnum:]]+@[[:alnum:]]+ \(serial [[:digit:]]+\) CA )?(RSA|ED25519) [:.[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Bad packet length [[:digit:]]+\. \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Bad protocol version identification '[^']*' from [:.[:xdigit:]]+ port [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: banner exchange: Connection from [[:xdigit:].:]+ port [[:digit:]]+: could not read protocol version$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: banner exchange: Connection from [[:xdigit:].:]+ port [[:digit:]]+: invalid format$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: channel_by_id: 1: bad id: channel free$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: channel_input_success_failure: 1: unknown$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Connection (closed|reset) by (authenticating|invalid) user [[:alnum:][:punct:][:space:]]* [:.[:xdigit:]]+ port [[:digit:]]+ \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Connection (closed|reset) by [:.[:xdigit:]]+ port [[:digit:]]+( \[preauth\])?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Corrupted MAC on input\. \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Could not write ident string to UNKNOWN$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Did not receive identification string from ([:[:xdigit:].]+|UNKNOWN)+ port [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnected from (authenticating|invalid) user [[:alnum:][:punct:][:space:]]* [:[:xdigit:].]+ port [[:digit:]]+ \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnected from user [[:alnum:]]+ [:[:xdigit:].]+ port [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnected from [:[:xdigit:].]+ port [[:digit:]]+ \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting (authenticating|invalid) user [[:alnum:][:punct:]]* [:.[:xdigit:]]+ port [[:digit:]]+: Change of username or service not allowed: \([^,]*,ssh-connection\) -> \([^,]*,[^)]+\)? \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting (authenticating|invalid) user [[:alnum:][:punct:]]* [:.[:xdigit:]]+ port [[:digit:]]+: Too many authentication failures \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: bad client public DH value \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: Change of username or service not allowed: \([^,]*,ssh-connection\) -> \([^,]*,[^)]+\)? \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: Packet corrupt \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: Too many authentication failures for (invalid user|root) [[:alnum:]]+ from [[:digit:].]+ port [[:digit:]]+ ssh2 \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: Too many authentication failures \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: drop connection #[[:digit:]]+ from \[[:.[:xdigit:]]+\]:[[:digit:]]+ on \[[:.[:xdigit:]]+\]:[[:digit:]]+ past MaxStartups$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: Bad remote protocol version identification: 'SSH-2.0-?'$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: beginning MaxStartups throttling$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: connect_to .* port [[:digit:]]+: failed\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex_exchange_identification: banner line contains invalid characters$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex_exchange_identification: client sent invalid protocol identifier ".*"$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex_exchange_identification: Connection closed by remote host$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex_exchange_identification: Connection reset by peer$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex_exchange_identification: read: Connection reset by peer$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: kex protocol error: type 30 seq 1 \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: maximum authentication attempts exceeded for (invalid user [[:alnum:][:space:][:digit:]@\\!._-]*|root|sshd|mysql|ftp|nagios|postgres|redis) from [:.[:xdigit:]]+ port [[:digit:]]+ ssh2 \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: PAM: Authentication failure for( illegal user)? [^[:space:]]* from ([:.[:xdigit:]]+|UNKNOWN|[-_.[:alnum:]]+)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: PAM: service\(sshd\) ignoring max retries; [[:digit:]] > [[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: PAM: User not known to the underlying authentication module for illegal user [^[:space:]]* from [^[:space:]]*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Protocol major versions differ( for [[:xdigit:]:.]+ port [[:digit:]]+)?: .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?10: user closed connection \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Bafta \\\\n \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: BUNNYBYTEv0.1 \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: BYE!BYE! \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: (Bye )?(Goodb|B)ye \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Client disconnecting normally \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Closed due to user request\. \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Cooling down ;\) \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: [Dd]isconnected by user \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Disconnected on user's request\. \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: disconnect \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: end \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: FlowSshPacketDecoder: unresponsiveness timeout \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Inchidere normala \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: JIHAD FROM BU. \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: logout \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Normal Shutdown(, Thank you for playing)? \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: ok \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Operation timeout \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: PECL\/ssh2 \(http:\/\/pecl\.php\.net\/packages\/ssh2\) \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: +\[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: Shutdown(, Thanks for playing)? \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: [[:space:]]*\[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?11: These aren't the droids we're looking for\. \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?13: (Closed due to )?[Uu]ser request\.? \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?13: Unable to authenticate \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?14: no authentication methods available \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?14: No more user authentication methods available. \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?14: Unable to connect using the available authentication methods \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?2: Handshake failed \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: com\.jcraft\.jsch\.JSchException: Auth (cancel|fail) \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: com\.jcraft\.jsch\.JSchException: reject HostKey: [:.[:alnum:]]+ \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: com\.jcraft\.jsch\.JSchException: timeout in waiting for rekeying process\. \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: com\.jcraft\.jsch\.JSchException: UnknownHostKey: [[:xdigit:]:.]+\. RSA key fingerprint is [[:xdigit:]:.]+ \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: com\.jcraft\.jsch\.JSchException: verify: false \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: java\.net\.SocketTimeoutException: Read timed out \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: org\.vngx\.jsch\.userauth\.AuthCancelException: User authentication canceled by user \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?3: Tamir\.SharpSsh\.jsch\.JSchException: Auth fail\\\\r\\\\n \\\\320\\\\262 Tamir\.SharpSsh\.jsch\.Session\.connect\(Int32 connectTimeout\) \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?7: Service not available \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: (error: )?Received disconnect from [:.[:xdigit:]]+ port [[:digit:]]+: ?7: User interaction is not allowed \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: send_error: write: Connection reset by peer$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: exited MaxStartups throttling after [[:digit:]:]+, [[:digit:]]+ connections dropped$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Failed (keyboard-interactive/pam|password|none) for (i(llegal|nvalid) user )?.* from ([:.[:xdigit:]]+|UNKNOWN|[-_.[:alnum:]]+) port [[:digit:]]{1,5} ssh2?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: no hostkey alg \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: no matching cipher found: client .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: no matching mac found: client .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Read from socket failed: Connection reset by peer \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Unable to negotiate a key exchange method \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: userauth_finish: (Connection reset by peer|Broken pipe) \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Write failed: (Connection reset by peer|Broken pipe) \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: input_userauth_request: invalid user [[:alnum:][:space:].:+-]+\[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: invalid public DH value: <= 1 \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Invalid user [[:alnum:][:space:][:digit:][:punct:]]* from [:.[:xdigit:]]+ port [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: packet_write_wait: Connection from authenticating user [[:alnum:][:space:][:digit:][:punct:]]* [:.[:xdigit:]]+ port [[:digit:]]+: Broken pipe \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: packet_write_wait: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: Broken pipe \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: PAM service\(sshd\) ignoring max retries; [[:digit:]] > [[:digit:]]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: pam_unix\(sshd:auth\): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=[^[:space:]]+([[:space:]]+user=(root|nobody|backup|daemon|www-data|games|news|mail|lp|sync|uucp|identd|gnats|irc|list|proxy|sys|nagios|mysql|bin|ftp|sshd|smmsp|snmp|man|ntp|quagga|libuuid|Debian-exim|proftpd|logcheck|vmail|statd|dovecot|postfix|puppet|bacula))?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: pam_unix\(sshd:auth\): bad username [[:alnum:][:space:][:digit:][:punct:]]*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: pam_unix\(sshd:auth\): check pass; user unknown
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Postponed (publickey|keyboard-interactive) for ([^[:space:]]+|invalid user)[[:space:]]+from [^[:space:]]+ port [[:digit:]]+ ssh2 \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received signal 15; terminating\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from (authenticating|invalid) user [[:alnum:][:space:][:digit:][:punct:]]* [:.[:xdigit:]]+ port [[:digit:]]+: message authentication code incorrect \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: bignum is negative \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: Broken pipe \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: Connection corrupted \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: DH GEX group out of range \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: incomplete message \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: message authentication code incorrect \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from [:.[:xdigit:]]+ port [[:digit:]]+: invalid format \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Unable to negotiate with [:.[:xdigit:]]+ port [[:digit:]]+: no matching (cipher|key exchange method|host key type|MAC) found\. Their offer: .* \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: User [._[:alnum:]-]+ from [[:alnum:].-]+ not allowed because none of user's groups are listed in AllowGroups$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes \[preauth\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: warning: can't get client address: Connection reset by peer$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: WARNING: no suitable primes in /etc/ssh/moduli$
-^DISABLED\w{3} [ :0-9]{11} [._[:alnum:]-]+ bounced\[[0-9]+\]: main::update_subscriber_bounce_history\(\) Received bounce for email address [[:alnum:].-]+@[[:alnum:].-]+, list [[:alnum:].-]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bulk\[[0-9]+\]: Done sending message [[:alnum:]]+ to list [[:alnum:].-]+@lists\.netwichtig\.de \(priority [[:digit:]]\) in [[:digit:]] seconds since scheduled expedition date\. Now sending VERP\.$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: List::send_msg_digest\(\) No subscriber for sending digest in list [[:alnum:].-]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: main::DoFile\(\) Processing \/var\/spool\/sympa\/msg\/[[:alnum:].-]+@lists\.netwichtig\.de\.[[:digit:]]{10}\.[[:digit:]]{4,5} ; sender: [[:alnum:] "<>.-@]+#012 ; message-id: <[[:alnum:].-]+@[[:alnum:].-]+>#012$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: main::DoMessage\(\) Message for [[:alnum:].-]+ from [[:alnum:].-]+@[[:alnum:].-]+ accepted \([[:digit:]]+ seconds, [[:digit:]]+ sessions, [[:digit:]]+ subscribers\), message-id=<[[:alnum:].-]+@[[:alnum:].-]+>#012, size=[[:digit:]]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: main::DoMessage\(\) Processing message for [[:alnum:].-]+ with priority [[:digit:]], <[[:alnum:].-]+@[[:alnum:].-]+>#012$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: main::DoSendMessage\(\) Message for [[:alnum:].-]+@[[:alnum:].-]+\.[[:alnum:]]+ sent$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: main::DoSendMessage\(\) Processing web message for [[:alnum:].-]+@[[:alnum:].-]+\.[[:alnum:]]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: main::SendDigest\(\) Digest of the list [[:alnum:].-]+ sent \([[:digit:]]+ seconds\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: main::SendDigest\(\) Sending digest to list [[:alnum:].-]+@lists.netwichtig.de$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: tools::CleanSpool\(\) Deleting old directory \/var\/spool\/sympa\/moderation\/[[:alnum:].-]+@lists\.netwichtig\.de_[[:alnum:]]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: tools::CleanSpool\(\) Deleting old file \/var\/spool\/sympa\/msg\/bad\/[[:alnum:].-]+@lists\.netwichtig\.de\.[[:digit:]]{10}\.[[:digit:]]{5}$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sympa\[[0-9]+\]: tools::CleanSpool\(\) Deleting old file \/var\/spool\/sympa\/tmp\/[[:digit:]]{5}\.stderr$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.eval_bouncers\._global$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.expire_bounce\._global$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.process_bouncers\._global$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_logs_table\._global$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_one_time_ticket_table\._global$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_orphan_bounces\._global$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_session_table\._global$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_tables\._global$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_user_table\._global$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/eval_bouncers\.daily\.task$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/expire_bounce\.daily\.task$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/process_bouncers.weekly.task$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_logs_table\.daily\.task$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_one_time_ticket_table.daily.task$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_orphan_bounces\.monthly\.task$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_session_table\.daily\.task$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_tables.daily.task$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_user_table\.monthly\.task$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::eval_bouncers\(\) eval_bouncers\([[:alnum:].-]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.eval_bouncers\._global, line 0 with vars \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.expire_bounce\._global, line 0 with vars \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.process_bouncers\._global, line 0 with vars \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_logs_table\._global, line 0 with vars \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_one_time_ticket_table\._global, line 0 with vars \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_orphan_bounces\._global, line 0 with vars \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_session_table\._global, line 0 with vars \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_tables\._global, line 0 with vars \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_user_table\._global, line 0 with vars \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of eval_bouncers : next \([[:digit:]]{10}, ACTION\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of expire_bounce : next \([[:digit:]]{10}, ACTION\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of process_bouncers : next \([[:digit:]]{10}, ACTION\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_logs_table : next \([[:digit:]]{10}, ACTION\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_one_time_ticket_table : next \([[:digit:]]{10}, ACTION\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_orphan_bounces : next \([[:digit:]]{10}, ACTION\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_session_table : next \([[:digit:]]{10}, ACTION\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_tables : next \([[:digit:]]{10}, ACTION\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_user_table : next \([[:digit:]]{10}, ACTION\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task eval_bouncers \([[:alnum:][:space:]]{33}\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task expire_bounce \([[:alnum:][:space:]]{33}\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task process_bouncers \([[:alnum:][:space:]]{33}\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_logs_table \([[:alnum:][:space:]]{33}\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_one_time_ticket_table \([[:alnum:][:space:]]{33}\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_orphan_bounces \([[:alnum:][:space:]]{33}\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_session_table \([[:alnum:][:space:]]{33}\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_tables \([[:alnum:][:space:]]{33}\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_user_table \([[:alnum:][:space:]]{33}\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::process_bouncers\(\) Processing automatic actions on bouncing users$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_logs_table\(\) purge_logs_table\(\): logs purged$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_one_time_ticket_table\(\) purge_one_time_ticket_table\(\): [[:digit:]]+ row removed in one_time_ticket_table$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_one_time_ticket_table\(\) task_manager::purge_one_time_ticket_table\(\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_orphan_bounces\(\) No bouncing subscribers in list [[:alnum:].-]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_orphan_bounces\(\) purge_orphan_bounces\(\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_session_table\(\) purge_session_table\(\): [[:digit:]]+ row removed in session_table$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_session_table\(\) task_manager::purge_session_table\(\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_tables\(\) [[:digit:]]+ rows removed in bulkspool_table$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_tables\(\) task_manager::purge_tables\(\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: SympaSession::purge_old_sessions\(\) SympaSession::purge_old_sessions\(\*,\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ task_manager\[[0-9]+\]: SympaSession::purge_old_tickets\(\) SympaSession::purge_old_tickets\(\*,\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: Auth::authentication\(\) authentication: incorrect password for user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: Auth::create_one_time_ticket\(\) Auth::create_one_time_ticket\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+,lists\.netwichtig\.de,choosepasswd,[0-9.]{7,15}\) value = [[:digit:]]{10}$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: Auth::get_one_time_ticket\(\) xxxx Auth::get_one_time_ticket\([[:digit:]]{14}\) : result : closed$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: Auth::get_one_time_ticket\(\) xxxx Auth::get_one_time_ticket\([[:digit:]]{14}\) : result : success$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: List::parseCustomAttribute\(\) Failed to parse XML data$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[alt [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_home\(\) do_home$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[alt [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_logout\(\) do_logout: logout performed$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_info\(\) do_info$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_login\(\) do_login\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_sigrequest\(\) do_sigrequest\(\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_subrequest\(\) do_subrequest\(,\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_subscribe\(\) do_subscribe\(\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::check_action_parameters\(\) user not logged in$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_loginrequest\(\) do_loginrequest$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_help\(\) do_help\(([[:alnum:]_]+)?\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_home\(\) do_home$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_firstpasswd\(\) do_firstpasswd\(\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] (\[rss\] )?main::do_lists\(\) do_lists\([[:alnum:],]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] (\[rss\] )?main::do_latest_lists\(\) do_latest_lists\(, [[:alnum:]]+,[[:alnum:]]*, \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] (\[rss\] )?main::do_active_lists\(\) do_active_lists\(, [[:alnum:]]+,[[:alnum:]]*, \)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_login\(\) do_login\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_login\(\) do_login: missing parameter passwd$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_logout\(\) do_logout: logout performed$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_renewpasswd\(\) do_renewpasswd\(([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+)?\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_requestpasswd\(\) do_requestpasswd\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_ticket\(\) do_ticket\([[:digit:]]{14}\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] unknown action sendpasswd$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_add\(\) do_add\(\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_add\(\) do_add\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+,\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_add_request\(\) do_add_request\(\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_admin\(\) do_admin$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_compose_mail\(\) do_compose_mail$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_editsubscriber\(\) do_editsubscriber\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_info\(\) do_info$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_reviewbouncing\(\) do_reviewbouncing\(0\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_review\(\) do_review\(0\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] (\[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] )?\[list [[:alnum:].-]+\] main::do_rss_request\(\) do_rss_request$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_subindex\(\) do_subindex$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_suboptions\(\) do_suboptions\(\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_viewbounce\(\) do_viewbounce\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_viewlogs\(\) do_viewlogs\([[:alnum:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_choosepasswd\(\) do_choosepasswd$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_home\(\) do_home$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_lists\(\) do_lists\(,\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_login\(\) do_login\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_login\(\) do_login: user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+ already logged in$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_logout\(\) do_logout\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_pref\(\) do_pref$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_redirect\(\) do_redirect\([[:alnum:]:/.-]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_redirect\(\) do_redirect\(https://lists.netwichtig.de/wws\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_ticket\(\) do_ticket\([[:digit:]]{14}\)$
-
+#^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bounced\[[0-9]+\]: main::update_subscriber_bounce_history\(\) Received bounce for email address [[:alnum:].-]+@[[:alnum:].-]+, list [[:alnum:].-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bulk\[[0-9]+\]: Done sending message [[:alnum:]]+ to list [[:alnum:].-]+@lists\.netwichtig\.de \(priority [[:digit:]]\) in [[:digit:]] seconds since scheduled expedition date\. Now sending VERP\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: List::send_msg_digest\(\) No subscriber for sending digest in list [[:alnum:].-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: main::DoFile\(\) Processing \/var\/spool\/sympa\/msg\/[[:alnum:].-]+@lists\.netwichtig\.de\.[[:digit:]]{10}\.[[:digit:]]{4,5} ; sender: [[:alnum:] "<>.-@]+#012 ; message-id: <[[:alnum:].-]+@[[:alnum:].-]+>#012$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: main::DoMessage\(\) Message for [[:alnum:].-]+ from [[:alnum:].-]+@[[:alnum:].-]+ accepted \([[:digit:]]+ seconds, [[:digit:]]+ sessions, [[:digit:]]+ subscribers\), message-id=<[[:alnum:].-]+@[[:alnum:].-]+>#012, size=[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: main::DoMessage\(\) Processing message for [[:alnum:].-]+ with priority [[:digit:]], <[[:alnum:].-]+@[[:alnum:].-]+>#012$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: main::DoSendMessage\(\) Message for [[:alnum:].-]+@[[:alnum:].-]+\.[[:alnum:]]+ sent$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: main::DoSendMessage\(\) Processing web message for [[:alnum:].-]+@[[:alnum:].-]+\.[[:alnum:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: main::SendDigest\(\) Digest of the list [[:alnum:].-]+ sent \([[:digit:]]+ seconds\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: main::SendDigest\(\) Sending digest to list [[:alnum:].-]+@lists.netwichtig.de$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: tools::CleanSpool\(\) Deleting old directory \/var\/spool\/sympa\/moderation\/[[:alnum:].-]+@lists\.netwichtig\.de_[[:alnum:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: tools::CleanSpool\(\) Deleting old file \/var\/spool\/sympa\/msg\/bad\/[[:alnum:].-]+@lists\.netwichtig\.de\.[[:digit:]]{10}\.[[:digit:]]{5}$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sympa\[[0-9]+\]: tools::CleanSpool\(\) Deleting old file \/var\/spool\/sympa\/tmp\/[[:digit:]]{5}\.stderr$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.eval_bouncers\._global$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.expire_bounce\._global$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.process_bouncers\._global$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_logs_table\._global$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_one_time_ticket_table\._global$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_orphan_bounces\._global$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_session_table\._global$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_tables\._global$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) creation of \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_user_table\._global$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/eval_bouncers\.daily\.task$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/expire_bounce\.daily\.task$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/process_bouncers.weekly.task$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_logs_table\.daily\.task$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_one_time_ticket_table.daily.task$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_orphan_bounces\.monthly\.task$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_session_table\.daily\.task$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_tables.daily.task$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::create\(\) with model \/usr\/share\/sympa\/default\/global_task_models\/purge_user_table\.monthly\.task$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::eval_bouncers\(\) eval_bouncers\([[:alnum:].-]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.eval_bouncers\._global, line 0 with vars \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.expire_bounce\._global, line 0 with vars \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.process_bouncers\._global, line 0 with vars \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_logs_table\._global, line 0 with vars \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_one_time_ticket_table\._global, line 0 with vars \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_orphan_bounces\._global, line 0 with vars \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_session_table\._global, line 0 with vars \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_tables\._global, line 0 with vars \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::execute\(\) Running task \/var\/spool\/sympa\/task\/[[:digit:]]{10}\.ACTION\.purge_user_table\._global, line 0 with vars \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of eval_bouncers : next \([[:digit:]]{10}, ACTION\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of expire_bounce : next \([[:digit:]]{10}, ACTION\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of process_bouncers : next \([[:digit:]]{10}, ACTION\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_logs_table : next \([[:digit:]]{10}, ACTION\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_one_time_ticket_table : next \([[:digit:]]{10}, ACTION\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_orphan_bounces : next \([[:digit:]]{10}, ACTION\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_session_table : next \([[:digit:]]{10}, ACTION\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_tables : next \([[:digit:]]{10}, ACTION\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) line [[:digit:]] of purge_user_table : next \([[:digit:]]{10}, ACTION\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task eval_bouncers \([[:alnum:][:space:]]{33}\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task expire_bounce \([[:alnum:][:space:]]{33}\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task process_bouncers \([[:alnum:][:space:]]{33}\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_logs_table \([[:alnum:][:space:]]{33}\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_one_time_ticket_table \([[:alnum:][:space:]]{33}\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_orphan_bounces \([[:alnum:][:space:]]{33}\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_session_table \([[:alnum:][:space:]]{33}\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_tables \([[:alnum:][:space:]]{33}\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::next_cmd\(\) --> new task purge_user_table \([[:alnum:][:space:]]{33}\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::process_bouncers\(\) Processing automatic actions on bouncing users$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_logs_table\(\) purge_logs_table\(\): logs purged$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_one_time_ticket_table\(\) purge_one_time_ticket_table\(\): [[:digit:]]+ row removed in one_time_ticket_table$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_one_time_ticket_table\(\) task_manager::purge_one_time_ticket_table\(\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_orphan_bounces\(\) No bouncing subscribers in list [[:alnum:].-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_orphan_bounces\(\) purge_orphan_bounces\(\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_session_table\(\) purge_session_table\(\): [[:digit:]]+ row removed in session_table$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_session_table\(\) task_manager::purge_session_table\(\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_tables\(\) [[:digit:]]+ rows removed in bulkspool_table$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: main::purge_tables\(\) task_manager::purge_tables\(\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: SympaSession::purge_old_sessions\(\) SympaSession::purge_old_sessions\(\*,\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ task_manager\[[0-9]+\]: SympaSession::purge_old_tickets\(\) SympaSession::purge_old_tickets\(\*,\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: Auth::authentication\(\) authentication: incorrect password for user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: Auth::create_one_time_ticket\(\) Auth::create_one_time_ticket\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+,lists\.netwichtig\.de,choosepasswd,[0-9.]{7,15}\) value = [[:digit:]]{10}$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: Auth::get_one_time_ticket\(\) xxxx Auth::get_one_time_ticket\([[:digit:]]{14}\) : result : closed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: Auth::get_one_time_ticket\(\) xxxx Auth::get_one_time_ticket\([[:digit:]]{14}\) : result : success$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: List::parseCustomAttribute\(\) Failed to parse XML data$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[alt [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_home\(\) do_home$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[alt [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_logout\(\) do_logout: logout performed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_info\(\) do_info$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_login\(\) do_login\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_sigrequest\(\) do_sigrequest\(\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_subrequest\(\) do_subrequest\(,\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_subscribe\(\) do_subscribe\(\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::check_action_parameters\(\) user not logged in$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[list [[:alnum:].-]+\] main::do_loginrequest\(\) do_loginrequest$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_help\(\) do_help\(([[:alnum:]_]+)?\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_home\(\) do_home$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_firstpasswd\(\) do_firstpasswd\(\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] (\[rss\] )?main::do_lists\(\) do_lists\([[:alnum:],]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] (\[rss\] )?main::do_latest_lists\(\) do_latest_lists\(, [[:alnum:]]+,[[:alnum:]]*, \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] (\[rss\] )?main::do_active_lists\(\) do_active_lists\(, [[:alnum:]]+,[[:alnum:]]*, \)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_login\(\) do_login\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_login\(\) do_login: missing parameter passwd$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_logout\(\) do_logout: logout performed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_renewpasswd\(\) do_renewpasswd\(([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+)?\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_requestpasswd\(\) do_requestpasswd\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] main::do_ticket\(\) do_ticket\([[:digit:]]{14}\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] unknown action sendpasswd$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_add\(\) do_add\(\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_add\(\) do_add\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+,\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_add_request\(\) do_add_request\(\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_admin\(\) do_admin$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_compose_mail\(\) do_compose_mail$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_editsubscriber\(\) do_editsubscriber\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_info\(\) do_info$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_reviewbouncing\(\) do_reviewbouncing\(0\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_review\(\) do_review\(0\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] (\[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] )?\[list [[:alnum:].-]+\] main::do_rss_request\(\) do_rss_request$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_subindex\(\) do_subindex$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_suboptions\(\) do_suboptions\(\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_viewbounce\(\) do_viewbounce\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] \[list [[:alnum:].-]+\] main::do_viewlogs\(\) do_viewlogs\([[:alnum:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_choosepasswd\(\) do_choosepasswd$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_home\(\) do_home$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_lists\(\) do_lists\(,\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_login\(\) do_login\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_login\(\) do_login: user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+ already logged in$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_logout\(\) do_logout\([[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_pref\(\) do_pref$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_redirect\(\) do_redirect\([[:alnum:]:/.-]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_redirect\(\) do_redirect\(https://lists.netwichtig.de/wws\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wwsympa\[[0-9]+\]: \[robot [._[:alnum:]-]+\] \[session [[:digit:]]+\] \[client [[:digit:]A-Fa-f.:]+\] \[user [[:alnum:].-]+@[[:alnum:]-]+.[[:alnum:]]+\] main::do_ticket\(\) do_ticket\([[:digit:]]{14}\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Access the GUI via the following URL: http://127.0.0.1:8384/$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Completed initial scan of sendreceive folder "[[:alnum:][:space:]]+" \([[:alnum:]-]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Connection to [[:alnum:]-]+ at .* closed: (closed by remote: )?Syncthing is being stopped$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Connection to .* closed: replacing connection
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: c\.S\.listenerSupervisor: Exiting backoff state\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Detected 1 NAT service$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Device [[:alnum:]-]+ client is "syncthing [[:alnum:].-]+" named "[[:alnum:]]+" at .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Device [[:alnum:]-]+ is "[[:alnum:]]+" at \[dynamic\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Disconnected from relay .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Established secure connection to .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Exiting$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Failed to exchange Hello messages with [[:alnum:]-]+ at .*: EOF$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Failed to exchange Hello messages with [[:alnum:]-]+ at .*: read tcp .*: i/o timeout$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Failed to exchange Hello messages with [[:alnum:]-]+ at .*: write: connection reset by peer$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: GUI and API listening on 127.0.0.1:8384$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Hashing performance is [[:digit:].]+ MB/s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Joined relay relay://[[:digit:].]+:[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: My ID: [[:alnum:]-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: My name is "[[:alnum:]]+"$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Overall send rate is unlimited, receive rate is unlimited$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: quic://0.0.0.0:22000 detected NAT type: Port restricted NAT$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: quic://0.0.0.0:22000 resolved external address quic://[[:digit:].]+:1024 \(via stun.syncthing.net:3478\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: quic://0.0.0.0:22000 resolved external address quic://[[:digit:].]+:22000 \(via stun.syncthing.net:3478\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: QUIC listener \(\[::\]:22000\) shutting down$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: QUIC listener \(\[::\]:22000\) starting$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Ready to synchronize "[[:alnum:][:space:]]+" \([[:alnum:]-]+\) \(sendreceive\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Relay listener \(dynamic\+https://relays.syncthing.net/endpoint\) shutting down$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Relay listener \(dynamic\+https://relays.syncthing.net/endpoint\) starting$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Replacing old connection .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Single thread SHA256 performance is [[:digit:]]+ MB/s using minio/sha256-simd \([[:digit:]]+ MB/s using crypto/sha256\)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Starting deadlock detector with 20m0s timeout$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Stored folder metadata for "[[:alnum:]-]+" is 720h0m0s old; recalculating$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: TCP listener \(\[::\]:22000\) shutting down$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: TCP listener \(\[::\]:22000\) starting$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Using discovery mechanism: global discovery server https[[:alnum:]_.:/?&=-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Using discovery mechanism: IPv4 local broadcast discovery on port [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Using discovery mechanism: IPv6 local multicast discovery on address \[[[:xdigit:]:]+\]:[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: [[:digit:][:space:]/:]+ connection doesn't allow setting of receive buffer size. See https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size for details\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[monitor\] INFO: Signal 1 received; restarting$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[start\] INFO: syncthing v[[:alnum:].-]+ "[[:alnum:][:space:]]+" \(go[[:digit:].]+ linux-amd64\) debian@debian [[:digit:]-]+ [[:digit:]:]+ UTC$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Access the GUI via the following URL: http://127.0.0.1:8384/$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Completed initial scan of sendreceive folder "[[:alnum:][:space:]]+" \([[:alnum:]-]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Connection to [[:alnum:]-]+ at .* closed: (closed by remote: )?Syncthing is being stopped$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Connection to .* closed: replacing connection
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: c\.S\.listenerSupervisor: Exiting backoff state\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Detected 1 NAT service$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Device [[:alnum:]-]+ client is "syncthing [[:alnum:].-]+" named "[[:alnum:]]+" at .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Device [[:alnum:]-]+ is "[[:alnum:]]+" at \[dynamic\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Disconnected from relay .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Established secure connection to .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Exiting$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Failed to exchange Hello messages with [[:alnum:]-]+ at .*: EOF$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Failed to exchange Hello messages with [[:alnum:]-]+ at .*: read tcp .*: i/o timeout$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Failed to exchange Hello messages with [[:alnum:]-]+ at .*: write: connection reset by peer$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: GUI and API listening on 127.0.0.1:8384$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Hashing performance is [[:digit:].]+ MB/s$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Joined relay relay://[[:digit:].]+:[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: My ID: [[:alnum:]-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: My name is "[[:alnum:]]+"$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Overall send rate is unlimited, receive rate is unlimited$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: quic://0.0.0.0:22000 detected NAT type: Port restricted NAT$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: quic://0.0.0.0:22000 resolved external address quic://[[:digit:].]+:1024 \(via stun.syncthing.net:3478\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: quic://0.0.0.0:22000 resolved external address quic://[[:digit:].]+:22000 \(via stun.syncthing.net:3478\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: QUIC listener \(\[::\]:22000\) shutting down$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: QUIC listener \(\[::\]:22000\) starting$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Ready to synchronize "[[:alnum:][:space:]]+" \([[:alnum:]-]+\) \(sendreceive\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Relay listener \(dynamic\+https://relays.syncthing.net/endpoint\) shutting down$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Relay listener \(dynamic\+https://relays.syncthing.net/endpoint\) starting$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Replacing old connection .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Single thread SHA256 performance is [[:digit:]]+ MB/s using minio/sha256-simd \([[:digit:]]+ MB/s using crypto/sha256\)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Starting deadlock detector with 20m0s timeout$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Stored folder metadata for "[[:alnum:]-]+" is 720h0m0s old; recalculating$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: TCP listener \(\[::\]:22000\) shutting down$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: TCP listener \(\[::\]:22000\) starting$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Using discovery mechanism: global discovery server https[[:alnum:]_.:/?&=-]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Using discovery mechanism: IPv4 local broadcast discovery on port [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[[[:alnum:]]+\] INFO: Using discovery mechanism: IPv6 local multicast discovery on address \[[[:xdigit:]:]+\]:[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: [[:digit:][:space:]/:]+ connection doesn't allow setting of receive buffer size. See https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size for details\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[monitor\] INFO: Signal 1 received; restarting$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ syncthing\[[[:digit:]]+\]: \[start\] INFO: syncthing v[[:alnum:].-]+ "[[:alnum:][:space:]]+" \(go[[:digit:].]+ linux-amd64\) debian@debian [[:digit:]-]+ [[:digit:]:]+ UTC$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Activated swap [^[:space:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Activating swap [^[:space:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: [[:alnum:]@-]+\.service: Consumed [[:digit:].]+s CPU time\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: [[:alnum:]-]+\.socket: Succeeded\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: [[:alnum:]_-]+\.timer: Succeeded\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Closed D-Bus User Message Bus Socket\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Closed LVM2 poll daemon socket\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Closed Sound System\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Condition check resulted in .* being skipped\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Created slice system-lvm2\x2dpvscan\.slice\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Created slice User Application Slice\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Created slice User Slice of UID [[:digit:]]+\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Finished .*
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Found device .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Listening on ACPID Listen Socket\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Listening on D-Bus User Message Bus Socket\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: media-[[:alnum:]]+-[[:alnum:]_\-]+.mount: Succeeded\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Mounted .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Mounting .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Operation 'sleep' finished\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Queued start job for default target Main User Target\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Reached target Local File Systems \(Pre\)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Reached target Network \(Pre\)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Reloaded The Apache HTTP Server\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Reloading The Apache HTTP Server\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Removed slice system-modprobe\.slice\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Removed slice User Application Slice\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Removed slice User Slice of UID [[:digit:]]+\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: run-user-[[:digit:]]+.mount: Succeeded\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: session-[[:digit:]]+\.scope: Consumed [[:digit:].]+s CPU time\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Started Rule-based Manager for Device Events and Files\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Started Syncthing - Open Source Continuous File Synchronization for [[:alnum:]]+\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting Daily man-db regeneration\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting D-Bus User Message Bus Socket\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting exim4-base housekeeping\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting File System Check on [^[:space:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting getty on tty2-tty6 if dbus and logind are not available\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting LVM event activation on device 254:5\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting Rule-based Manager for Device Events and Files\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Startup finished in [[:digit:]]+ms\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped Daily exim4-base housekeeping\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped Daily man-db regeneration\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped D-Bus User Message Bus\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped getty on tty2-tty6 if dbus and logind are not available\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped Syncthing - Open Source Continuous File Synchronization for [[:alnum:]]+\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped target Multi-User System\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopping D-Bus User Message Bus\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopping LSB: exim Mail Transport Agent\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopping LVM event activation on device 254:5\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Suspending system\.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: syncthing@[[:alnum:]]+.service: Scheduled restart job, restart counter is at [[:digit:]]+\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: syncthing@[[:alnum:]]+.service: Succeeded\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: System resumed\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: user@[[:digit:]]+.service: Succeeded\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: user-[[:digit:]]+.slice: Consumed [[:digit:].]+s CPU time\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: user-runtime-dir@[[:digit:]]+.service: Succeeded\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd-fsck\[[[:digit:]]+\]: [^[:space:]]+: clean, [[:digit:]]+/[[:digit:]]+ files, [[:digit:]]+/[[:digit:]]+ blocks$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd-udevd\[[[:digit:]]+\]: Using default interface naming scheme 'v247'\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Activated swap [^[:space:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Activating swap [^[:space:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: [[:alnum:]@-]+\.service: Consumed [[:digit:].]+s CPU time\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: [[:alnum:]-]+\.socket: Succeeded\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: [[:alnum:]_-]+\.timer: Succeeded\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Closed D-Bus User Message Bus Socket\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Closed LVM2 poll daemon socket\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Closed Sound System\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Condition check resulted in .* being skipped\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Created slice system-lvm2\x2dpvscan\.slice\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Created slice User Application Slice\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Created slice User Slice of UID [[:digit:]]+\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Finished .*
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Found device .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Listening on ACPID Listen Socket\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Listening on D-Bus User Message Bus Socket\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: media-[[:alnum:]]+-[[:alnum:]_\-]+.mount: Succeeded\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Mounted .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Mounting .*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Operation 'sleep' finished\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Queued start job for default target Main User Target\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Reached target Local File Systems \(Pre\)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Reached target Network \(Pre\)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Reloaded The Apache HTTP Server\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Reloading The Apache HTTP Server\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Removed slice system-modprobe\.slice\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Removed slice User Application Slice\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Removed slice User Slice of UID [[:digit:]]+\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: run-user-[[:digit:]]+.mount: Succeeded\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: session-[[:digit:]]+\.scope: Consumed [[:digit:].]+s CPU time\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Started Rule-based Manager for Device Events and Files\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Started Syncthing - Open Source Continuous File Synchronization for [[:alnum:]]+\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting Daily man-db regeneration\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting D-Bus User Message Bus Socket\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting exim4-base housekeeping\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting File System Check on [^[:space:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting getty on tty2-tty6 if dbus and logind are not available\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting LVM event activation on device 254:5\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Starting Rule-based Manager for Device Events and Files\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Startup finished in [[:digit:]]+ms\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped Daily exim4-base housekeeping\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped Daily man-db regeneration\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped D-Bus User Message Bus\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped getty on tty2-tty6 if dbus and logind are not available\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped Syncthing - Open Source Continuous File Synchronization for [[:alnum:]]+\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopped target Multi-User System\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopping D-Bus User Message Bus\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopping LSB: exim Mail Transport Agent\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Stopping LVM event activation on device 254:5\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: Suspending system\.\.\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: syncthing@[[:alnum:]]+.service: Scheduled restart job, restart counter is at [[:digit:]]+\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: syncthing@[[:alnum:]]+.service: Succeeded\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: System resumed\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: user@[[:digit:]]+.service: Succeeded\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: user-[[:digit:]]+.slice: Consumed [[:digit:].]+s CPU time\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[[:digit:]]+\]: user-runtime-dir@[[:digit:]]+.service: Succeeded\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd-fsck\[[[:digit:]]+\]: [^[:space:]]+: clean, [[:digit:]]+/[[:digit:]]+ files, [[:digit:]]+/[[:digit:]]+ blocks$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd-udevd\[[[:digit:]]+\]: Using default interface naming scheme 'v247'\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Average packaged cell fullness: [[:digit:].]+%\. TLS write overhead: [[:digit:]]+%$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Bootstrapped 0% \(starting\): Starting$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Heartbeat: Tor's uptime is ([[:digit:]]+ day(s)? )?[[:digit:]]+:[[:digit:]]+ hours, with [[:digit:]]+ circuits open. I've sent [[:digit:].]+ [GMk]B and received [[:digit:].]+ [GMk]B\.( I've received [[:digit:]]+ connections on IPv4 and [[:digit:]]+ on IPv6. I've made [[:digit:]]+ connections with IPv4 and [[:digit:]]+ with IPv6\.)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: http status 400 \("Nonauthoritative directory does not accept posted server descriptors"\) response from dirserver '[[:xdigit:]:.]+:[[:digit:]]+'\. Malformed rendezvous descriptor\?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Interrupt: exiting cleanly\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Our onion service received [[:digit:]]+ v2 and [[:digit:]]+ v3 INTRODUCE2 cells and attempted to launch [[:digit:]]+ rendezvous circuits\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Parsing GEOIP IPv4 file /usr/share/tor/geoip\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Parsing GEOIP IPv6 file /usr/share/tor/geoip6\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Received http status code 404 \("Consensus is too old"\) from server '[[:xdigit:]:.]+:443' while fetching consensus directory\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Starting with guard context "default"$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Tor has been idle for [[:digit:]]+ seconds; assuming established circuits no longer work\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: We compiled with OpenSSL 101010ef: OpenSSL 1\.1\.1n 15 Mar 2022 and we are running with OpenSSL 101010ef: 1.1.1n\. These two versions should be binary compatible\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: While (not )?bootstrapping, fetched this many bytes: [[:digit:]]+ \((consensus network-status fetch|authority cert fetch|microdescriptor fetch)\)(; [[:digit:]]+ \((consensus network-status fetch|authority cert fetch|microdescriptor fetch)\))*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Average packaged cell fullness: [[:digit:].]+%\. TLS write overhead: [[:digit:]]+%$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Bootstrapped 0% \(starting\): Starting$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Heartbeat: Tor's uptime is ([[:digit:]]+ day(s)? )?[[:digit:]]+:[[:digit:]]+ hours, with [[:digit:]]+ circuits open. I've sent [[:digit:].]+ [GMk]B and received [[:digit:].]+ [GMk]B\.( I've received [[:digit:]]+ connections on IPv4 and [[:digit:]]+ on IPv6. I've made [[:digit:]]+ connections with IPv4 and [[:digit:]]+ with IPv6\.)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: http status 400 \("Nonauthoritative directory does not accept posted server descriptors"\) response from dirserver '[[:xdigit:]:.]+:[[:digit:]]+'\. Malformed rendezvous descriptor\?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Interrupt: exiting cleanly\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Our onion service received [[:digit:]]+ v2 and [[:digit:]]+ v3 INTRODUCE2 cells and attempted to launch [[:digit:]]+ rendezvous circuits\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Parsing GEOIP IPv4 file /usr/share/tor/geoip\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Parsing GEOIP IPv6 file /usr/share/tor/geoip6\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Received http status code 404 \("Consensus is too old"\) from server '[[:xdigit:]:.]+:443' while fetching consensus directory\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Starting with guard context "default"$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Tor has been idle for [[:digit:]]+ seconds; assuming established circuits no longer work\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: We compiled with OpenSSL 101010ef: OpenSSL 1\.1\.1n 15 Mar 2022 and we are running with OpenSSL 101010ef: 1.1.1n\. These two versions should be binary compatible\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: While (not )?bootstrapping, fetched this many bytes: [[:digit:]]+ \((consensus network-status fetch|authority cert fetch|microdescriptor fetch)\)(; [[:digit:]]+ \((consensus network-status fetch|authority cert fetch|microdescriptor fetch)\))*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ udisksd\[[[:digit:]]+\]: Cleaning up mount point /media/[[:alnum:]_-]+/.* \(device [[:digit:]]+:0 is not mounted\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ udisksd\[[[:digit:]]+\]: Mounted /dev/sr0 at /media/[[:alnum:]]+/.* on behalf of uid [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ udisksd\[[[:digit:]]+\]: Unmounted /dev/sr0 on behalf of uid [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ udisksd\[[[:digit:]]+\]: Cleaning up mount point /media/[[:alnum:]_-]+/.* \(device [[:digit:]]+:0 is not mounted\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ udisksd\[[[:digit:]]+\]: Mounted /dev/sr0 at /media/[[:alnum:]]+/.* on behalf of uid [[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ udisksd\[[[:digit:]]+\]: Unmounted /dev/sr0 on behalf of uid [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] error: read \(in tcp r\): Connection reset by peer for [:.[:xdigit:]]+( port [[:digit:]]+)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: generate keytag query _ta-4f66\. NULL IN$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: service stopped \(unbound [[:digit:].]+\)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting#
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] notice: init module 0: subnet$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] notice: init module 1: validator$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] notice: init module 2: iterator$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: start of service \(unbound [[:digit:].]+\)\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: .*
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] error: read \(in tcp r\): Connection reset by peer for [:.[:xdigit:]]+( port [[:digit:]]+)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: generate keytag query _ta-4f66\. NULL IN$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: service stopped \(unbound [[:digit:].]+\)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting#
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] notice: init module 0: subnet$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] notice: init module 1: validator$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] notice: init module 2: iterator$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: start of service \(unbound [[:digit:].]+\)\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ unbound: \[[[:digit:]]+:0\] info: .*
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ vnstatd\[[[:digit:]]+\]: SIGTERM received, exiting\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ vnstatd\[[[:digit:]]+\]: vnStat daemon [[:digit:].]+ started\. \(pid:[[:digit:]]+ uid:[[:digit:]]+ gid:[[:digit:]]+ 64-bit\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ vnstatd\[[[:digit:]]+\]: Monitoring \([[:digit:]]+\): [[:alpha:]]+ \([[:digit:]]+ Mbit\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ vnstatd\[[[:digit:]]+\]: SIGTERM received, exiting\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ vnstatd\[[[:digit:]]+\]: vnStat daemon [[:digit:].]+ started\. \(pid:[[:digit:]]+ uid:[[:digit:]]+ gid:[[:digit:]]+ 64-bit\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ vnstatd\[[[:digit:]]+\]: Monitoring \([[:digit:]]+\): [[:alpha:]]+ \([[:digit:]]+ Mbit\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_action: (bssid=([0-9a-f]{2}:){5}[0-9a-f]{2}|ssid=[.[:alnum:]-]+|id=[0-9]+|id_str=[_[:alnum:]]*|freq=(24([1-6][27]|72|84)|5(2[046]|3[02]|5[068]|6[68]|70)0)|address=([0-9a-f]{2}:){5}[0-9a-f]{2}|uuid=[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12})$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_action: (creating|removing) sendsigs omission pidfile: /(run|lib/init/rw)/sendsigs\.omit\.d/wpasupplicant\.wpa_supplicant\.(wlan[0-9]|wlp[0-9]s[0-9])\.pid$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_action: ifdown (wlan[0-9]|wlp[0-9]s[0-9])$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_action: ifup (wlan[0-9]|wlp[0-9]s[0-9])=[_[:alnum:]]*$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_action: ip_address=(([0-9]|([1-9]|1[0-9]|2[0-4])[0-9]|25[0-5])\.){3}([0-9]|([1-9]|1[0-9]|2[0-4])[0-9]|25[0-5])$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_action: mode=station$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_action: (pairwise_cipher=(TKIP|CCMP)|group_cipher=(TKIP|CCMP)|key_mgmt=WPA2?(-PSK|/IEEE 802.1X/EAP)|wpa_state=COMPLETED)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_action: (Supplicant PAE state=AUTHENTICATED|suppPortStatus=Authorized|EAP state=SUCCESS|selectedMethod=25 \(EAP-PEAP\)|EAP TLS cipher=DHE-RSA-AES256-SHA|EAP-PEAPv0 Phase2 method=MSCHAPV2)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_action: (WPA_IFACE=(wlan[0-9]|wlp[0-9]s[0-9]) WPA_ACTION=CONNECTED|WPA_ID=[0-9]+ WPA_ID_STR=[_[:alnum:]]* WPA_CTRL_DIR=/var/run/wpa_supplicant)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_action: WPA_IFACE=(wlan[0-9]|wlp[0-9]s[0-9]) WPA_ACTION=DISCONNECTED$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: Associated with ([0-9a-f]{2}:){5}[0-9a-f]{2}$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-BEACON-LOSS$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-CONNECTED - Connection to ([0-9a-f]{2}:){5}[0-9a-f]{2} completed (\((re)?auth\) )?\[id=[0-9]+ id_str=[_[:alnum:]]*\]$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-DISCONNECTED bssid=([0-9a-f]{2}:){5}[0-9a-f]{2} reason=[0-9]( locally_generated=1)?$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=[^']*' hash=[[:xdigit:]]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+ -> NAK$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-EAP-(STARTED EAP authentication started|SUCCESS EAP authentication completed successfully|METHOD EAP vendor 0 method (17 \(LEAP|25 \(PEAP)\) selected)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-TERMINATING$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: (SME: )?Trying to (authenticate|associate) with ([0-9a-f]{2}:){5}[0-9a-f]{2} \(SSID='[.[:alnum:][:space:]-]+' freq=(24([1-6][27]|72|84)|5(2[046]|3[02]|5[068]|6[68]|70)0) MHz\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: WPA: Group rekeying completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[GTK=(CCMP|TKIP)\]$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: WPA: Key negotiation completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[PTK=(CCMP|TKIP) GTK=(CCMP|TKIP)\]$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: CTRL-EVENT-SCAN-(STARTED|RESULTS)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: EAP-MSCHAPV2: Authentication succeeded$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: EAP-TLV: TLV Result - Success - EAP-TLV/Phase2 Completed$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: nl80211: deinit ifname=[[:alnum:]]+ disabled_11b_rates=0$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\] Successfully initialized wpa_supplicant$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: WPS-AP-AVAILABLE$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: (bssid=([0-9a-f]{2}:){5}[0-9a-f]{2}|ssid=[.[:alnum:]-]+|id=[0-9]+|id_str=[_[:alnum:]]*|freq=(24([1-6][27]|72|84)|5(2[046]|3[02]|5[068]|6[68]|70)0)|address=([0-9a-f]{2}:){5}[0-9a-f]{2}|uuid=[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12})$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: (creating|removing) sendsigs omission pidfile: /(run|lib/init/rw)/sendsigs\.omit\.d/wpasupplicant\.wpa_supplicant\.(wlan[0-9]|wlp[0-9]s[0-9])\.pid$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: ifdown (wlan[0-9]|wlp[0-9]s[0-9])$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: ifup (wlan[0-9]|wlp[0-9]s[0-9])=[_[:alnum:]]*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: ip_address=(([0-9]|([1-9]|1[0-9]|2[0-4])[0-9]|25[0-5])\.){3}([0-9]|([1-9]|1[0-9]|2[0-4])[0-9]|25[0-5])$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: mode=station$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: (pairwise_cipher=(TKIP|CCMP)|group_cipher=(TKIP|CCMP)|key_mgmt=WPA2?(-PSK|/IEEE 802.1X/EAP)|wpa_state=COMPLETED)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: (Supplicant PAE state=AUTHENTICATED|suppPortStatus=Authorized|EAP state=SUCCESS|selectedMethod=25 \(EAP-PEAP\)|EAP TLS cipher=DHE-RSA-AES256-SHA|EAP-PEAPv0 Phase2 method=MSCHAPV2)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: (WPA_IFACE=(wlan[0-9]|wlp[0-9]s[0-9]) WPA_ACTION=CONNECTED|WPA_ID=[0-9]+ WPA_ID_STR=[_[:alnum:]]* WPA_CTRL_DIR=/var/run/wpa_supplicant)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: WPA_IFACE=(wlan[0-9]|wlp[0-9]s[0-9]) WPA_ACTION=DISCONNECTED$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: Associated with ([0-9a-f]{2}:){5}[0-9a-f]{2}$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-BEACON-LOSS$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-CONNECTED - Connection to ([0-9a-f]{2}:){5}[0-9a-f]{2} completed (\((re)?auth\) )?\[id=[0-9]+ id_str=[_[:alnum:]]*\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-DISCONNECTED bssid=([0-9a-f]{2}:){5}[0-9a-f]{2} reason=[0-9]( locally_generated=1)?$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=[^']*' hash=[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+ -> NAK$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-EAP-(STARTED EAP authentication started|SUCCESS EAP authentication completed successfully|METHOD EAP vendor 0 method (17 \(LEAP|25 \(PEAP)\) selected)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: CTRL-EVENT-TERMINATING$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: (SME: )?Trying to (authenticate|associate) with ([0-9a-f]{2}:){5}[0-9a-f]{2} \(SSID='[.[:alnum:][:space:]-]+' freq=(24([1-6][27]|72|84)|5(2[046]|3[02]|5[068]|6[68]|70)0) MHz\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: WPA: Group rekeying completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[GTK=(CCMP|TKIP)\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: [[:alnum:]]+: WPA: Key negotiation completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[PTK=(CCMP|TKIP) GTK=(CCMP|TKIP)\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: CTRL-EVENT-SCAN-(STARTED|RESULTS)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: EAP-MSCHAPV2: Authentication succeeded$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: EAP-TLV: TLV Result - Success - EAP-TLV/Phase2 Completed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: nl80211: deinit ifname=[[:alnum:]]+ disabled_11b_rates=0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\] Successfully initialized wpa_supplicant$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: WPS-AP-AVAILABLE$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Bluetooth daemon 5\.55$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Bluetooth management interface 1\.18 initialized$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: connect error: Host is down \([[:digit:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSink/sbc$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSink/sbc$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSource/sbc$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSource/sbc$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Exit$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: /org/bluez/hci[[:digit:]]+/dev_[[:xdigit:]_]+(/sep[[:digit:]]+)?/fd[[:digit:]]+: fd\([[:digit:]]+\) ready$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Starting SDP server$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Stopping SDP server$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Terminating$
-#^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get Headset Voice gateway SDP record: Connection refused$
-#^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get Headset Voice gateway SDP record: Host is down$
-#^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get io data for Headset Voice gateway: getpeername: Transport endpoint is not connected \([[:digit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Bluetooth daemon 5\.55$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Bluetooth management interface 1\.18 initialized$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: connect error: Host is down \([[:digit:]]+\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSink/sbc$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSink/sbc$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSource/sbc$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSource/sbc$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Exit$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: /org/bluez/hci[[:digit:]]+/dev_[[:xdigit:]_]+(/sep[[:digit:]]+)?/fd[[:digit:]]+: fd\([[:digit:]]+\) ready$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Starting SDP server$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Stopping SDP server$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Terminating$
+#^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get Headset Voice gateway SDP record: Connection refused$
+#^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get Headset Voice gateway SDP record: Host is down$
+#^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get io data for Headset Voice gateway: getpeername: Transport endpoint is not connected \([[:digit:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dbus\[[0-9]+\]: \[system\] Activating service name='[^']+' \(using servicehelper\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dbus\[[0-9]+\]: \[system\] Successfully activated service '[^']+'$
-
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dbus\[[0-9]+\]: \[system\] Activating service name='[^']+' \(using servicehelper\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ dbus\[[0-9]+\]: \[system\] Successfully activated service '[^']+'$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ org.kde.powerdevil.backlighthelper: QDBusConnection: system D-Bus connection created before QCoreApplication\. Application may misbehave\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ org.kde.powerdevil.backlighthelper: QDBusConnection: system D-Bus connection created before QCoreApplication\. Application may misbehave\.$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ NetworkManager\[[0-9]+\]: <info> Policy set 'Wired connection [[:digit:]]' (eth[[:digit:]]) as default for IPv[46] routing and DNS\.$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ NetworkManager\[[0-9]+\]: <info> Activation \(eth[[:digit:]]\) Stage [[:digit:]] of 5 \(.*\) (scheduled|started|complete)\.{1,3}$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ NetworkManager\[[0-9]+\]: <info> Policy set 'Wired connection [[:digit:]]' (eth[[:digit:]]) as default for IPv[46] routing and DNS\.$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ NetworkManager\[[0-9]+\]: <info> Activation \(eth[[:digit:]]\) Stage [[:digit:]] of 5 \(.*\) (scheduled|started|complete)\.{1,3}$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pulseaudio\[[0-9]+\]: \[alsa-source-USB Audio\] alsa-util.c: Got POLLNVAL from ALSA$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pulseaudio\[[0-9]+\]: \[alsa-sink-USB Audio\] alsa-util.c: Got POLLNVAL from ALSA$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pulseaudio\[[0-9]+\]: \[alsa-source-USB Audio\] alsa-util.c: Could not recover from POLLERR|POLLNVAL|POLLHUP with snd_pcm_prepare\(\): No such device$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pulseaudio\[[0-9]+\]: \[alsa-sink-USB Audio\] alsa-util.c: Could not recover from POLLERR|POLLNVAL|POLLHUP with snd_pcm_prepare\(\): No such device$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ pulseaudio\[[0-9]+\]: \[alsa-source-USB Audio\] alsa-util.c: Got POLLNVAL from ALSA$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ pulseaudio\[[0-9]+\]: \[alsa-sink-USB Audio\] alsa-util.c: Got POLLNVAL from ALSA$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ pulseaudio\[[0-9]+\]: \[alsa-source-USB Audio\] alsa-util.c: Could not recover from POLLERR|POLLNVAL|POLLHUP with snd_pcm_prepare\(\): No such device$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ pulseaudio\[[0-9]+\]: \[alsa-sink-USB Audio\] alsa-util.c: Could not recover from POLLERR|POLLNVAL|POLLHUP with snd_pcm_prepare\(\): No such device$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_action: (bssid=([0-9a-f]{2}:){5}[0-9a-f]{2}|ssid=[.[:alnum:]-]+|id=[0-9]+|id_str=[_[:alnum:]]*|freq=(24([1-6][27]|72|84)|5(2[046]|3[02]|5[068]|6[68]|70)0)|address=([0-9a-f]{2}:){5}[0-9a-f]{2}|uuid=[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12})$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_action: (creating|removing) sendsigs omission pidfile: /(run|lib/init/rw)/sendsigs\.omit\.d/wpasupplicant\.wpa_supplicant\.(wlan[0-9]|wlp[0-9]s[0-9])\.pid$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_action: ifdown (wlan[0-9]|wlp[0-9]s[0-9])$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_action: ifup (wlan[0-9]|wlp[0-9]s[0-9])=[_[:alnum:]]*$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_action: ip_address=(([0-9]|([1-9]|1[0-9]|2[0-4])[0-9]|25[0-5])\.){3}([0-9]|([1-9]|1[0-9]|2[0-4])[0-9]|25[0-5])$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_action: mode=station$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_action: (pairwise_cipher=(TKIP|CCMP)|group_cipher=(TKIP|CCMP)|key_mgmt=WPA2?(-PSK|/IEEE 802.1X/EAP)|wpa_state=COMPLETED)$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_action: (Supplicant PAE state=AUTHENTICATED|suppPortStatus=Authorized|EAP state=SUCCESS|selectedMethod=25 \(EAP-PEAP\)|EAP TLS cipher=DHE-RSA-AES256-SHA|EAP-PEAPv0 Phase2 method=MSCHAPV2)$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_action: (WPA_IFACE=(wlan[0-9]|wlp[0-9]s[0-9]) WPA_ACTION=CONNECTED|WPA_ID=[0-9]+ WPA_ID_STR=[_[:alnum:]]* WPA_CTRL_DIR=/var/run/wpa_supplicant)$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_action: WPA_IFACE=(wlan[0-9]|wlp[0-9]s[0-9]) WPA_ACTION=DISCONNECTED$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-DISCONNECTED bssid=([0-9a-f]{2}:){5}[0-9a-f]{2} reason=[0-9] locally_generated=1$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: CTRL-EVENT-EAP-(STARTED EAP authentication started|SUCCESS EAP authentication completed successfully|METHOD EAP vendor 0 method (17 \(LEAP|25 \(PEAP)\) selected)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: CTRL-EVENT-SCAN-(STARTED|RESULTS)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: EAP-MSCHAPV2: Authentication succeeded$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: EAP-TLV: TLV Result - Success - EAP-TLV/Phase2 Completed$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?Associated with ([0-9a-f]{2}:){5}[0-9a-f]{2}$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-CONNECTED - Connection to ([0-9a-f]{2}:){5}[0-9a-f]{2} completed (\((re)?auth\) )?\[id=[0-9]+ id_str=[_[:alnum:]]*\]$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-SUBNET-STATUS-UPDATE status=0$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]|enp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=[^']*' hash=[[:xdigit:]]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]|enp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]|enp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+ -> NAK$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]|enp[0-9]s[0-9]): )?CTRL-EVENT-EAP-(STARTED EAP authentication started|SUCCESS EAP authentication completed successfully|METHOD EAP vendor 0 method (17 \(LEAP|25 \(PEAP)\) selected)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?(SME: )?Trying to (authenticate|associate) with ([0-9a-f]{2}:){5}[0-9a-f]{2} \(SSID='[.[:alnum:]-]+' freq=(24([1-6][27]|72|84)|5(2[046]|3[02]|5[068]|6[68]|70)0) MHz\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?WPA: Group rekeying completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[GTK=(CCMP|TKIP)\]$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?WPA: Key negotiation completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[PTK=(CCMP|TKIP) GTK=(CCMP|TKIP)\]$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: (wlan[0-9]*: )?WPA: Group rekeying completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[GTK=(CCMP|TKIP)\]$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: WPS-AP-AVAILABLE$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: (wlan[0-9]|wlp[0-9]s[0-9]): PMKSA-CACHE-(REMOVED|ADDED) [[:xdigit:]:]+ 0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: (bssid=([0-9a-f]{2}:){5}[0-9a-f]{2}|ssid=[.[:alnum:]-]+|id=[0-9]+|id_str=[_[:alnum:]]*|freq=(24([1-6][27]|72|84)|5(2[046]|3[02]|5[068]|6[68]|70)0)|address=([0-9a-f]{2}:){5}[0-9a-f]{2}|uuid=[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12})$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: (creating|removing) sendsigs omission pidfile: /(run|lib/init/rw)/sendsigs\.omit\.d/wpasupplicant\.wpa_supplicant\.(wlan[0-9]|wlp[0-9]s[0-9])\.pid$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: ifdown (wlan[0-9]|wlp[0-9]s[0-9])$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: ifup (wlan[0-9]|wlp[0-9]s[0-9])=[_[:alnum:]]*$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: ip_address=(([0-9]|([1-9]|1[0-9]|2[0-4])[0-9]|25[0-5])\.){3}([0-9]|([1-9]|1[0-9]|2[0-4])[0-9]|25[0-5])$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: mode=station$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: (pairwise_cipher=(TKIP|CCMP)|group_cipher=(TKIP|CCMP)|key_mgmt=WPA2?(-PSK|/IEEE 802.1X/EAP)|wpa_state=COMPLETED)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: (Supplicant PAE state=AUTHENTICATED|suppPortStatus=Authorized|EAP state=SUCCESS|selectedMethod=25 \(EAP-PEAP\)|EAP TLS cipher=DHE-RSA-AES256-SHA|EAP-PEAPv0 Phase2 method=MSCHAPV2)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: (WPA_IFACE=(wlan[0-9]|wlp[0-9]s[0-9]) WPA_ACTION=CONNECTED|WPA_ID=[0-9]+ WPA_ID_STR=[_[:alnum:]]* WPA_CTRL_DIR=/var/run/wpa_supplicant)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_action: WPA_IFACE=(wlan[0-9]|wlp[0-9]s[0-9]) WPA_ACTION=DISCONNECTED$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-DISCONNECTED bssid=([0-9a-f]{2}:){5}[0-9a-f]{2} reason=[0-9] locally_generated=1$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: CTRL-EVENT-EAP-(STARTED EAP authentication started|SUCCESS EAP authentication completed successfully|METHOD EAP vendor 0 method (17 \(LEAP|25 \(PEAP)\) selected)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: CTRL-EVENT-SCAN-(STARTED|RESULTS)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: EAP-MSCHAPV2: Authentication succeeded$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: EAP-TLV: TLV Result - Success - EAP-TLV/Phase2 Completed$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?Associated with ([0-9a-f]{2}:){5}[0-9a-f]{2}$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-CONNECTED - Connection to ([0-9a-f]{2}:){5}[0-9a-f]{2} completed (\((re)?auth\) )?\[id=[0-9]+ id_str=[_[:alnum:]]*\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?CTRL-EVENT-SUBNET-STATUS-UPDATE status=0$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]|enp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=[^']*' hash=[[:xdigit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]|enp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]|enp[0-9]s[0-9]): )?CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=[[:digit:]]+ -> NAK$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]|enp[0-9]s[0-9]): )?CTRL-EVENT-EAP-(STARTED EAP authentication started|SUCCESS EAP authentication completed successfully|METHOD EAP vendor 0 method (17 \(LEAP|25 \(PEAP)\) selected)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?(SME: )?Trying to (authenticate|associate) with ([0-9a-f]{2}:){5}[0-9a-f]{2} \(SSID='[.[:alnum:]-]+' freq=(24([1-6][27]|72|84)|5(2[046]|3[02]|5[068]|6[68]|70)0) MHz\)$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?WPA: Group rekeying completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[GTK=(CCMP|TKIP)\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: ((wlan[0-9]|wlp[0-9]s[0-9]): )?WPA: Key negotiation completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[PTK=(CCMP|TKIP) GTK=(CCMP|TKIP)\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: (wlan[0-9]*: )?WPA: Group rekeying completed with ([0-9a-f]{2}:){5}[0-9a-f]{2} \[GTK=(CCMP|TKIP)\]$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: WPS-AP-AVAILABLE$
+^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ wpa_supplicant\[[0-9]+\]: (wlan[0-9]|wlp[0-9]s[0-9]): PMKSA-CACHE-(REMOVED|ADDED) [[:xdigit:]:]+ 0$
projects / user / henk / code / puppet / modules / logcheck.git / commitdiff