we would need to anchor it at the end accounting for " - password policy: 65535  grace: -1  expire: -1  bound: 0" trailer to avoid possible injection of loglines into 'user''s .*

Also -- why do you have .* after <HOST> -- I do not see it needed