May  6 17:24:02 snapubuntu su: (to snapattack) snapattack on pts/2
May  6 17:24:02 snapubuntu su: (to snapattack)  on pts/2
May  6 17:24:02 snapubuntu su: pam_unix(su:session): session opened for user snapattack(uid=0) by (uid=1000)