^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [[:alnum:]]+(\[[0-9]+\])?: nss_nonlocal: removing local group
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ [[:alnum:]]+(\[[0-9]+\])?: nss_nonlocal: possible spoofing attack
