^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nmbd\[[[:digit:]]+\]: connect from$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nmbd\[[[:digit:]]+\]: .* find_.*$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nmbd\[[0-9]+\]: \[[0-9 \/:,]+\] nmbd/nmbd.c:process\([0-9]+\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nmbd\[[0-9]+\]: \[[0-9 \/:,]+\] nmbd/nmbd_workgroupdb.c:dump_workgroups\([0-9]+\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nmbd\[[0-9]+\]: +dump_workgroups\(\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nmbd\[[0-9]+\]: +dump workgroup on subnet +(UNICAST_SUBNET|[0-9\.]+): netmask= +[0-9\.]+:$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nmbd\[[0-9]+\]: +.* current master browser = .*$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nmbd\[[0-9]+\]: +.* [0-9a-f]+ \(.*\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ smbd\[[[:digit:]]+\]: connect from$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ PAM_smbpass\[[[:digit:]]+\]: Located account for [-._[:alnum:]]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ PAM_smbpass\[[[:digit:]]+\]: password for \([-._[:alnum:]]+/[[:digit:]]+\) changed by \([-._[:alnum:]]+/[[:digit:]]+\)$