const regex = /(?:\*\*[^*]*\*\*[ ]pam_vas:)?\s+([^<:]*):?[ ]<([^>]*)>/g;
// Alternative syntax using RegExp constructor
// const regex = new RegExp('(?:\\*\\*[^*]*\\*\\*[ ]pam_vas:)?\\s+([^<:]*):?[ ]<([^>]*)>', 'g')
const str = `**Feb 16 20:04:37 hostname su[1111]: [id 123456 auth.info]:** pam_vas: Authentication <succeeded> for <active directory> user: <bobtheperson> account: <bobtheperson@com.com> reason: <N/A> Access cont(upn): <bob>`;
const subst = `\1 = \2\r`;
// The substituted value will be contained in the result variable
const result = str.replace(regex, subst);
console.log('Substitution result: ', result);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for JavaScript, please visit: https://developer.mozilla.org/en/docs/Web/JavaScript/Guide/Regular_Expressions