From c31eb1c562f2797aeb72c9d56e47cf134b5d504c Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Tue, 20 Mar 2018 16:00:21 +0100
Subject: [PATCH] quick optimization: normalizes pam-generic prefregex (more
 similar to the same regex within sshd-filter) + datepattern anchored now;

---
 config/filter.d/pam-generic.conf | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/pam-generic.conf b/config/filter.d/pam-generic.conf
index 8fd51826..0cadbeee 100644
--- a/config/filter.d/pam-generic.conf
+++ b/config/filter.d/pam-generic.conf
@@ -16,12 +16,14 @@ _ttys_re=\S*
 __pam_re=\(?%(__pam_auth)s(?:\(\S+\))?\)?:?
 _daemon = \S+
 
-prefregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=%(_ttys_re)s <F-CONTENT>.+</F-CONTENT>$
+prefregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure;(?:\s+(?:(?:logname|e?uid)=\S*)){0,3} tty=%(_ttys_re)s <F-CONTENT>.+</F-CONTENT>$
 
 failregex = ^ruser=<F-ALT_USER>(?:\S*|.*?)</F-ALT_USER> rhost=<HOST>(?:\s+user=<F-USER>(?:\S*|.*?)</F-USER>)?\s*$
 
 ignoreregex = 
 
+datepattern = {^LN-BEG}
+
 # DEV Notes:
 #
 # for linux-pam before 0.99.2.0 (late 2005) (removed before 0.8.11 release)