grep -E -v 'session (opened|closed) for user ' /var/log/auth.log