^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ smbd_audit: [[:alnum:]]+\|[[:alnum:]]+\|[.[:digit:]]{7,15}\|[[:alnum:][:space:]]+\|.+$
