^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sslh\[[[:digit:]]+\]: connection from [._[:alnum:]-]+:[[:digit:]]+ forwarded to (SSH|SSL)$
