$re = '/^.+Severity: 20.*\R^.*\R(?![\s\S]*Severity: 20)/m';
$str = '2020-01-27 11:12:00.72 Backup Log was backed up. Database: ReportServerTempDB, creation date(time): 2019/05/22(12:31:06), first LSN: 79:1911:1, last LSN: 79:1933:1, number of dump devices: 1, device information: (FILE=1, TYPE=DISK: {\'E:\\SQLLogDumps\\ReportServerTempDB_tlog_20200127111200.trn\'}). This is an informational message only. No user action is required.
2020-01-27 11:21:47.95 Logon Error: 17806, Severity: 20, State: 14.
2020-01-27 11:21:47.95 Logon Occurrence number one
2020-01-27 11:21:47.95 Logon Error: 18452, Severity: 14, State: 1.
2020-01-27 11:21:47.95 Logon Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. [CLIENT: 192.168.4.208]
2020-01-27 11:21:47.95 Logon Error: 17806, Severity: 20, State: 14.
2020-01-27 11:21:47.95 Logon Occurrence number two
2020-01-27 11:21:47.95 Logon Error: 18452, Severity: 14, State: 1.
2020-01-27 11:21:47.95 Logon Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. [CLIENT: 192.168.4.208]';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php