sshd_local 358 B

123
  1. ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Received disconnect from .*: [0-9]+: disconnected by user$
  2. ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: subsystem request for sftp by user .+$
  3. ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Accepted publickey for \w+ from [-:\.[:alnum:]]+ port [0-9]+ ssh2: RSA [:0-9a-f]+$