="user" AUID="user"
type=CRED_REFR msg=audit(1757602989.063:448): pid=6310 uid=1000 auid=1000 ses=1 subj=unconfined msg='op=PAM:setcred grantors=pam_faillock,pam_wheel,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'