$re = '/(?ms)EventCode=(4624|4634|4625)\s+.*\.adm/m';
$str = '03/08/2024 04:19:49 PM
LogName=Security
EventCode=4634
EventType=0
ComputerName=XXX
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=XXX
Keywords=Audit Success
TaskCategory=Logoff
OpCode=Info
Message=An account was logged off.
Subject:
Security ID: DOMINIO\\user.adm
Account Name: utente
Account Domain: AMADORI
Logon ID: XXX
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php