"syslog_sudo_cmd": { "query": "SELECT time,facility,tag,message FROM syslog s, time WHERE s.tag = 'sudo' AND s.message like '%COMMAND=%' AND s.time > (time.local_time - 10);", "interval": 10, "removed" : false }