title: Python regex to parse contents of sudoers log that spans accross multiple lines
body: <p>I would need to extract date, user and command executed from a few hundred sudo.log files. 
  the problem is that the sudo log entries are spaned across multiple lines and the command can have multiple lines. </p>
  
  <p>an example of a entries in sudoers is like this: </p>
  
  <pre><code>Aug  7 14:14:43 : user1 : TTY=pts/53 ; PWD=/path2 ;
      USER=root ; COMMAND=/path/to/cmd1
  Aug  7 14:14:49 : user2 : TTY=pts/53 ; PWD=/usr/home ;
      USER=root ; COMMAND=./myscript.sh -m name -o SCHEDULER
  Aug  7 14:15:14 : user3 : TTY=pts/34 ;
      PWD=/path ; USER=root ;
      COMMAND=/usr/bin/egrep ^[a-z]*
      /filename/toto1234
  Aug  7 14:15:37 : user4 : TTY=unknown ; PWD=/opt/nagios ; USER=root ;
      COMMAND=/path/to/less
      /var/opt/otherfile
  Aug  7 14:16:04 : user4 : TTY=pts/34 ;
      PWD=/usr/local/bin/script ; USER=root ;
      COMMAND=/usr/bin/egrep ^[a-z]*
      /user/local/sbin/tata
  </code></pre>
  
  <p>What a have noticed is each entry of the sudoers start with the date. followed by a colon then the user and then on other line the command exectuted. I would like to capture the date, user and command.. </p>
  
  <p>I think i should capture everything comming after COMMAND until the date is found again? </p>
  
  <p>I have this regx that capture the date and username because they tend to be on the same line but don't know how capture the COMMAND</p>
  
  <p>this is what I have so far: </p>
  
  <pre><code>(^\w{3}\s+\d+\s\d+:\d+:\d+)\s?:\s?(\w+?)\s+:.*
  </code></pre>
  
  <p>i have been testing it here: </p>
  
  <p><a href="https://regex101.com/r/qFnv0t/2/" rel="nofollow noreferrer">https://regex101.com/r/qFnv0t/2/</a></p>
  
  <p>my idea is perhaps for the command capture everything until group1 is matches again? or first i  need to modify the log files and make one entry per line? </p>
  
  <p>thank you for your insight. </p>