$re = '/user="(?<user1>\w+)| admin="(?<user2>\w+)/m';
$str = 'Jun 2 11:16:44 192.168.55.19 1 2020-06-02T10:16:43.721Z chisdsm@abcd.com dsm 4493 USR1278I [U@21513 sev="INFO" msg="user logged out due to inactivity" user="SC08"]
Jun 2 10:13:50 192.168.55.19 1 2020-06-02T09:13:50.297Z chisdsm@abcd.com dsm 4493 DO0426I [DA@21513 sev="INFO" msg="switch domain" admin="SC08"
Jun 2 10:13:43 192.168.55.19 1 2020-06-02T09:13:42.956Z chisdsm@abcd.com dsm 4493 DAO0267I [DA@21513 sev="INFO" msg="user logged in" admin="SC08" stime="2020-06-02 10:13:42.944" role="ALL_ADMIN" source="192.168.54.9"]
May 27 15:53:38 192.168.55.129 1 2020-05-27T14:53:37.669Z chisdsm@abcd.com dsm 4493 DAO0227I [DA@21513 sev="INFO" msg="delete file signature" user="SC08" filePath="/bin/rm"]';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php