kazulog@sv1:~$ sudo journalctl --no-pager -o short-precise | awk '/STEP2-BEGIN-20260912-101552/{f=1} f'
Sep 12 10:16:39.020372 sv1 KAZULOG[3162]: STEP2-BEGIN-20260912-101552
Sep 12 10:16:39.071075 sv1 sshd-session[3076]: syslogin_perform_logout: logout() returned an error
Sep 12 10:16:39.072616 sv1 sshd-session[3129]: Received disconnect from 10.100.3.1 port 53577:11: disconnected by user
Sep 12 10:16:39.073374 sv1 sshd-session[3129]: Disconnected from user kazulog 10.100.3.1 port 53577
Sep 12 10:16:39.074549 sv1 sshd-session[3076]: pam_unix(sshd:session): session closed for user kazulog
Sep 12 10:16:39.077325 sv1 systemd[1]: session-14.scope: Deactivated successfully.
Sep 12 10:16:39.080642 sv1 systemd-logind[1133]: Session 14 logged out. Waiting for processes to exit.
Sep 12 10:16:39.084068 sv1 systemd-logind[1133]: Removed session 14.
Sep 12 10:16:39.229113 sv1 sshd-session[3174]: Accepted publickey for kazulog from 10.100.3.1 port 53578 ssh2: ED25519 SHA256:NdURwOz/PbiL79UHvTtYE5vuTJfA2RD5RXsn/rG76rw
Sep 12 10:16:39.234697 sv1 sshd-session[3174]: pam_unix(sshd:session): session opened for user kazulog(uid=1000) by kazulog(uid=0)
Sep 12 10:16:39.245187 sv1 systemd-logind[1133]: New session '15' of user 'kazulog' with class 'user' and type 'tty'.
Sep 12 10:16:39.250630 sv1 systemd[1]: Started session-15.scope - Session 15 of User kazulog.
Sep 12 10:16:39.587079 sv1 sudo[3271]: pam_unix(sudo:session): session opened for user root(uid=0) by kazulog(uid=1000)
Sep 12 10:16:39.587922 sv1 sudo[3271]: kazulog : TTY=/dev/pts/0 ; PWD=/home/kazulog ; USER=root ; COMMAND=/usr/sbin/useradd -m -s /bin/bash ftpdemo
Sep 12 10:16:39.663245 sv1 useradd[3274]: new group: name=ftpdemo, GID=1001
Sep 12 10:16:39.665275 sv1 useradd[3274]: new user: name=ftpdemo, UID=1001, GID=1001, home=/home/ftpdemo, shell=/bin/bash, from=/dev/pts/1
Sep 12 10:16:39.796696 sv1 sudo[3271]: pam_unix(sudo:session): session closed for user root
Sep 12 10:16:39.844021 sv1 sudo[3289]: pam_unix(sudo:session): session opened for user root(uid=0) by kazulog(uid=1000)
Sep 12 10:16:39.844138 sv1 sudo[3289]: kazulog :  PWD=/home/kazulog ; USER=root ; COMMAND=/usr/sbin/chpasswd
Sep 12 10:16:39.901492 sv1 chpasswd[3292]: pam_unix(chpasswd:chauthtok): password changed for ftpdemo
Sep 12 10:16:39.904107 sv1 sudo[3289]: pam_unix(sudo:session): session closed for user root
Sep 12 10:16:40.006649 sv1 sudo[3317]: pam_unix(sudo:session): session opened for user ftpdemo(uid=1001) by kazulog(uid=1000)
Sep 12 10:16:40.007520 sv1 sudo[3317]: kazulog :  PWD=/home/kazulog ; USER=ftpdemo ; COMMAND=/usr/bin/tee /home/ftpdemo/hello.txt
Sep 12 10:16:40.015071 sv1 sudo[3317]: pam_unix(sudo:session): session closed for user ftpdemo
Sep 12 10:16:40.042433 sv1 sshd-session[3174]: syslogin_perform_logout: logout() returned an error
Sep 12 10:16:40.043668 sv1 sshd-session[3227]: Received disconnect from 10.100.3.1 port 53578:11: disconnected by user
Sep 12 10:16:40.044484 sv1 sshd-session[3227]: Disconnected from user kazulog 10.100.3.1 port 53578
Sep 12 10:16:40.045975 sv1 sshd-session[3174]: pam_unix(sshd:session): session closed for user kazulog
Sep 12 10:16:40.048881 sv1 systemd[1]: session-15.scope: Deactivated successfully.
Sep 12 10:16:40.052633 sv1 systemd-logind[1133]: Session 15 logged out. Waiting for processes to exit.
Sep 12 10:16:40.056344 sv1 systemd-logind[1133]: Removed session 15.
Sep 12 10:16:40.181170 sv1 sshd-session[3332]: Accepted publickey for kazulog from 10.100.3.1 port 53579 ssh2: ED25519 SHA256:NdURwOz/PbiL79UHvTtYE5vuTJfA2RD5RXsn/rG76rw
Sep 12 10:16:40.186142 sv1 sshd-session[3332]: pam_unix(sshd:session): session opened for user kazulog(uid=1000) by kazulog(uid=0)
Sep 12 10:16:40.197904 sv1 systemd-logind[1133]: New session '16' of user 'kazulog' with class 'user' and type 'tty'.
Sep 12 10:16:40.199299 sv1 systemd[1]: Started session-16.scope - Session 16 of User kazulog.
Sep 12 10:16:40.497622 sv1 sudo[3418]: pam_unix(sudo:session): session opened for user root(uid=0) by kazulog(uid=1000)
Sep 12 10:16:40.498305 sv1 sudo[3418]: kazulog : TTY=/dev/pts/0 ; PWD=/home/kazulog ; USER=root ; COMMAND=/usr/bin/journalctl --no-pager -o short-precise