###SAMPLE
#Jun  6 22:22:45 server-VirtualBox sudo: pam_unix(sudo:session): session opened for user root by #server(uid=1000)
match = /(.*)?server-VirtualBox (.*)?: (.*)?: session opened for user ([.*])? /.match(s)

#Problem: i get "root by" in match[4] when i am only expecting "root"