Jul  8 16:45:52 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Jul  8 16:45:52 raspberrypi sudo:       pi : TTY=pts/0 ; PWD=/ ; USER=root ; COMMAND=/bin/systemctl stop systemd-journald
Jul  8 16:45:52 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
Jul  8 16:45:52 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Jul  8 16:45:59 raspberrypi sudo:       pi : TTY=pts/0 ; PWD=/ ; USER=root ; COMMAND=/bin/mkdir -p /media/pi/My_Passport/var_log
Jul  8 16:45:59 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
Jul  8 16:45:59 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Jul  8 16:45:59 raspberrypi sudo:       pi : TTY=pts/0 ; PWD=/ ; USER=root ; COMMAND=/usr/bin/rsync -aXS /var/log/ /media/pi/My_Passport/var_log/
Jul  8 16:45:59 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)