kazulog@sv1:~$ sudo journalctl -u ssh --since '3 min ago' --no-pager | grep -E 'taro' | tail -5
Sep 10 14:47:34 sv1 sshd-session[3981]: Accepted password for taro from 10.100.3.1 port 63884 ssh2
Sep 10 14:47:34 sv1 sshd-session[3981]: pam_unix(sshd:session): session opened for user taro(uid=1001) by taro(uid=0)
Sep 10 14:47:35 sv1 sshd-session[3981]: pam_unix(sshd:session): session closed for user taro