using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"(?P<syslog_date>\S+\s+\d+\s+\d+:\d+:\d+)\s+0\s+(?P<log_date>\d+-\d+-\d+T\d+:\s\d+:\d+[^\s]+)\s+.*?(?:(?P<device>[^\s:]+)\s+)?(?P<application>ora_[^\s:]+_Audit)\s+-\s+-\s+Audit\[\d+\]:\s+(?:[^]]+]\s+)?(?:LENGTH:\s+\""(?P<length>\d+)\"".*?)?SESSIONID:(?:\[\d+\])?\s+\""(?P<sessionid>\d+)\"".*?ENTRYID:(?:\[\d+\])?\s+\""(?P<entryid>\d+)\"".*?(?:STATEMENT:(?:\[\d+\])?\s+\""(?P<statement>.*?)\"")?.*?USERID:(?:\[\d+\])?\s+\""(?P<userid>.*?)\"".*?(?:USERHOST:(?:\[\d+\])\s+""(?:(?P<host_domain>[^\\""]+)\\+)?(?P<userhost>[^""]*)"")?\s+(?:TERMINAL:(?:\[\d+\])\s+""(?P<terminal>[^""]*)""\s+)?ACTION:(?:\[\d+\])?\s+\""(?P<action>\d+)\"".*?RETURNCODE:(?:\[\d+\])?\s+\""(?P<code>.*?)\"".*?(?:COMMENT\$TEXT:(?:\[\d+\])?.*?\""Authenticated\s+by:\s+(?P<auth_by>\S+)(?:\;\s+Client\s+address:\s+\(ADDRESS\=\(PROTOCOL\=tcp\)\(HOST\=(?P<host>\d+\.\d+\.\d+\.\d+)\)\(PORT\=(?P<port>\d+)\)\).*?|""\s+)|OBJ\$CREATOR:(?:\[\d+\])?\s+\""(?P<objcreator>[^""]*)""\s+.*?OBJ\$NAME:(?:\[\d+\])?\s+\""(?P<objname>[^""]*)""\s+)OS\$USERID:(?:\[\d+\])?\s+\""(?P<osuserid>[^""]*)""\s*(?:(?!PRIV\$)\S+\s+)*(?:PRIV\$USED:(?:\[\d+\])?\s+""(?P<priv>[^""]*)"")?";
string input = @"Mar 31 00:02:54 0 2020-03-31T00: 02:53.629415+02:00 localhost ora_AM_Audit - - Audit[29579]: LENGTH: ""379"" SESSIONID:[9] ""130549450"" ENTRYID:[1] ""1"" STATEMENT:[1] ""1"" USERID:[15] ""EFACTURA_CDATOS"" USERHOST:[9] ""EFPRE-TRX"" ACTION:[3] ""100"" RETURNCODE:[1] ""0"" COMMENT$TEXT:[102] ""Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.200.237)(PORT=44530))"" OS$USERID:[9] ""efamerica"" DBID:[10] ""3787855415"" PRIV$USED:[1] ""5"" CURRENT_USER:[15] ""EFACTURA_CDATOS""";
RegexOptions options = RegexOptions.Multiline;
foreach (Match m in Regex.Matches(input, pattern, options))
{
Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index);
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx