{
    "eventid": "13695",
    "items": {
        "USER_AUTH": [
            "pid=6072 uid=0 auid=4294967295 ses=4294967295 subj==unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/sbin/lightdm\" hostname=? addr=? terminal=:0 res=failed' UID=\"root\" AUID=\"unset\""
        ]
    },
    "node": "192.168.137.195",
    "timestamp": "1575984475",
    "timestampfractional": "889"
}