Process auth.log entries