1 **Phase 1: Completed pre-decoding.
2 full event: 'Jun 8 09:01:01 niban su(pam_unix)[1313]: session opened for user root by (uid=1342)'
5 log: 'Jun 8 09:01:01 niban su(pam_unix)[1313]: session opened for user root by (uid=1342)'
7 **Phase 2: Completed decoding.