SSH_AUTH_SUCCESS
case SSH_AUTH_SUCCESS:
{SSH_AUTH_SUCCESS, "AUTH_SUCCESS"},
audit_event(ssh, SSH_AUTH_SUCCESS);