1 **Phase 1: Completed pre-decoding.
2 full event: 'Jun 9 13:32:14 niban su(pam_unix)[1338]: session opened for user root by (uid=1342)'
5 log: 'Jun 9 13:32:14 niban su(pam_unix)[1338]: session opened for user root by (uid=1342)'
7 **Phase 2: Completed decoding.