using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"(^type=AVC msg=audit\((?<time>\w+).*: apparmor=\""(?<resolution>\w+)\"" operation=\""(?<operation>\w+)\""( profile=\""(?<profile>[^ ]+)\""){0,1}( name=\""(?<name>[^ ]+)\""){0,1} pid=(?<pid>\d+) comm=\""{0,1}(?<comm>[^ ]+)\""{0,1}( requested_mask=\""(?<requested_mask>\w+)\"" denied_mask=\""(?<denied_mask>\w+)\"" fsuid=(?<fsuid>\d+))?|^type=(?<type>\w+) msg=audit\((?<time1>\w+).*: pid=(?<pid1>\d+) uid=(?<uid>\d+) .* msg='(?<message>.*)'|type=NETFILTER_CFG msg=audit\((?<time2>\w+).*: table=(?<table>[^ ]+) family=(?<family>\d+) entries=(?<entries>\d+)|type=ANOM_PROMISCUOUS msg=audit\((?<time3>\w+).*: dev=(?<device>[^ ]+) prom=(?<prom>\d+) old_prom=(?<old_prom>\d+).*)|type=DAEMON\w+ msg=audit\((?<time4>\w+).*: (?<message1>.*)|type=CONFIG_CHANGE msg=audit\((?<time5>\w+).*: (?<message2>.*)";
string input = @"type=DAEMON_START msg=audit(1450609493.002:6827): auditd start, ver=2.4 format=raw kernel=4.3.0 auid=4294967295 pid=2491 subj=unconfined res=success";
Match m = Regex.Match(input, pattern);
Console.WriteLine("'{0}' found at index {1}", m.Value, m.Index);
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx