'auth' => '(\w+\(pam_unix\)\[.*\]: )',
'kernel' => '(kernel: (?!DROP_))',
'ipsec' => '(ipsec_[\w_]+: |pluto\[.*\]: |vpnwatch: )',
'auth' => '(\w+\(pam_unix\)\[.*\]: )',
'kernel' => '(kernel: (?!DROP_))',
'ipsec' => '(ipsec_[\w_]+: |pluto\[.*\]: |vpnwatch: )',