Changes to the auth_log_parser to also catch root login attempts