r" AUID="user"
type=USER_CMD msg=audit(1757794987.944:346): pid=5118 uid=1000 auid=1000 ses=1 subj=unconfined msg='cwd="/home/user" cmd=2F62696E2F6C73626C6B202D2D6E6F68656164696E6773202D2D726177202D2D6F757470757420524F exe="/usr/bin/sudo" terminal=? res=success'