$re = '/(?ms)Binding\s+Type:\s+0/m';
$str = 'LogName=Directory Service
SourceName=Microsoft-Windows-ActiveDirectory_DomainService
EventCode=2889
EventType=4
Type=Information
ComputerName=XXXXX
User=NOT_TRANSLATED
Sid=S-1-5-7
SidType=0
TaskCategory=LDAP Interface
OpCode=The operation completed successfully.
RecordNumber=7362133
Keywords=Classic
Message=The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection.
Client IP address:
1.1.11.1:5555
Identity the client attempted to authenticate as:
XXX\\XXXX
Binding Type:
0';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php