s/  cwd/ cwd/
s/  comm=/ comm=/
s/msg='//
s/(hostname=/hostname=/
s/success)/success/
s/ : exe=/ exe=/
s/'$//
s/):  a/): a/
s/, addr=/ addr=/
s/, terminal=/ terminal=/
s/tty pid=/pid=/
s/Unknown permission start for class system //
s/Unknown permission stop for class system //
s/  exe=/ exe=/
s/ pam: default-context/ default-context/
s/ avc:  denied  { stop } for auid=/ auid=/
s/old ses=/ses=/
s/new ses=/ses=/
s/old auid=/auid=/
s/login pid=/pid=/
s/user pid=/pid=/
s/new auid=/auid=/
s/auditd start, ver=/ver=/
s/policy loaded auid=/auid=/
s/auditd normal halt, sending auid=/auid=/
s/op=change password id=/op=change id=/
s/avc:  received policyload notice (seqno=\(\d+)\))/seqno=\1/
s/PAM: accounting acct/acct/
s/PAM: session open acct/acct/
s/PAM: session close acct/acct/
s/PAM: setcred acct/acct/
s/avc:  denied  { read write } for  pid=/seresult=denied seperms=read,write pid=/