## services, and other units
# https://sources.debian.org/src/systemd/252.4-1/src/core/job.c/#L600-L610
# https://sources.debian.org/src/systemd/252.4-1/src/core/job.c/#L538-L542
# not including: Reloaded/Reloading
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: (Start|Stopp)ed .+\.$
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: (Start|Stopp)ing .+\.$

# https://sources.debian.org/src/systemd/252.4-1/src/core/unit.c/?hl=5589#L5589
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: [^ ]+: Deactivated successfully\.$

# possibly https://sources.debian.org/src/systemd/252.4-1/src/core/unit.c/#L2739 ?
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: [^ ]+: Succeeded\.$

# possibly https://sources.debian.org/src/systemd/252.4-1/src/core/unit.c/#L2307 (line 2474 converts the "consumed"->"Consumed")?
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: [^ ]+: Consumed .+ CPU time\.$

# services with Type=Oneshot service print 'Finished' on exit
# https://sources.debian.org/src/systemd/252.4-1/src/core/service.c/#L4604
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: Finished .+\.$

# services with Restart=always ((eg console-getty.service)
# https://sources.debian.org/src/systemd/252.4-1/src/core/service.c/#L2378
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: [^ ]+\.service: Scheduled restart job, restart counter is at [0-9]+\.$

## timers
# no longer produced normally?
#^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: [^ ]+\.timer: Adding .+ random time\.$

## slices
# https://sources.debian.org/src/systemd/252.4-1/src/core/slice.c/#L455-L458 .status_message_formats
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: (Creat|Remov)ed slice .+\.$

## targets
# https://sources.debian.org/src/systemd/252.4-1/src/core/target.c/#L208-L213
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: Reached target .+\.$

## sockets
# https://sources.debian.org/src/systemd/252.4-1/src/core/socket.c/#L3521-L3528
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: Listening on .+\.$
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: Closed .+\.$

# https://sources.debian.org/src/systemd/252.4-1/src/core/manager.c/?hl=2934#L2934 says this only logged at debug level
#^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: Time has been changed$


## The following seem to be produced only when systemd-sysv is installed (which is usually the case)
# https://sources.debian.org/src/systemd/252.5-2/src/core/main.c/?hl=2266#L2266
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: Queued start job for default target .+\.$

# https://sources.debian.org/src/systemd/252.5-2/src/core/manager.c/?hl=3526#L3526
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: Startup finished in [0-9]+ms\.$

# systemd-sysuser
^([[:alpha:]]{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ systemd\[[0-9]+\]: pam_unix\(systemd-user:session\): session opened for user [[:alnum:]-]+\(uid=[0-9]+\) by \(uid=0\)$
