Hi, I am playing with secure.log entries for sshd and am able to find transactions based on pid from below; Sep 12 13:15:41 www sshd[19475]: Accepted password for root from a.b.c.d port 53966 ssh2 Sep 12 13:15:45 www sshd[19475]: Received disconnect from a.b.c.d: 11: disconnected by user index=secure | transaction pid startswith="Accepted" endswith=" by user" However for non root users a child process is spawned and a transaction looks like this; Sep 12 13:16:03 www sshd[19502]: Accepted password for user from a.b.c.d port 53967 ssh2 Sep 12 13:16:03 www sshd[19502]: User child is on pid 19508 Sep 12 13:16:09 www sshd[19508]: Received disconnect from a.b.c.d: 11: disconnected by user Now the whole pid thing breaks down and I am not sure how to create a transaction for this case, let alone a search command that can deal with both cases. Any pointers are highly appreciated. ... View more