regex101: PCRE (Legacy) Match Workspace

Userthe literal text User (case sensitive)

\s+any whitespace character, repeated at least once

Non-Capturing Group(?:Authentication\s+)?

?repeats the group contents below at most once:

Authenticationthe literal text Authentication (case sensitive)

\s+any whitespace character, repeated at least once

Group 1(authenticated|Successful|Failed)

1st Alternativeauthenticated

authenticatedthe literal text authenticated (case sensitive)

2nd AlternativeSuccessful

Successfulthe literal text Successful (case sensitive)

3rd AlternativeFailed

Failedthe literal text Failed (case sensitive)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

Search reference

Regular Expression

User\s+(?:Authentication\s+)?(authenticated|Successful|Failed):

New

Oct 23 03:49:53 lab2 authmgr[1883]: <522008> <NOTI> <lab2 192.168.1.10>  User Authentication Successful: username=mary.jane MAC=c0:aa:d1:db:7d:f8 IP=192.168.2.34 role=authenticated VLAN=601 AP=32.3.4 SSID=ssidlab AAA profile=Auth_AaaProfile auth method=802.1x auth server=radius.lab.com
Oct 23 03:50:36 2015 [192.168.1.2] authmgr[596]: <522008> <NOTI> |authmgr|  User authenticated: Name=john.doe MAC=d8:45:95:37:19:3a IP=192.168.1.24 method=802.1x server=radius.lab.com role=authenticated