grep 'cos' auth.log	1/1 Z 1 a)
awk '$1=="Nov" && $2==23 && $3>=12	2/1 Z 1 a)