$re = '/(?<monthname>^\w{3})\s(?<daynumber>\d{2})\s(?<logtime>.{8})\s*(?<entrytype>((NMAS-[0-9].....).|log4cxx:|Started|DHLog:|NetIQ eDirectory CEF|SASL|NetIQ PKI|LDAP Agent|SPM DClient|NMAS|Mandatory Access Control|NDS iMonitor|Information:|Graded Authentication Management)(?<value>.*))/m';
$str = 'Feb 11 07:13:51 log4cxx: IO Exception : status code = 104
Feb 11 07:13:51 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 07:13:51 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 07:13:43 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=sadec86.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 07:10:03 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=ihrligt.OU=Int.OU=people.dc=nationwidedir.dc=net
Feb 11 07:09:37 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=jstamler.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 07:09:20 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=71877bjm2.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 07:08:47 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=dlroberts330.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 07:07:23 log4cxx: IO Exception : status code = 104
Feb 11 07:07:23 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 06:46:02 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 06:46:02 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 06:39:40 log4cxx: IO Exception : status code = 104
Feb 11 06:39:40 log4cxx: IO Exception : status code = 104
Feb 11 06:39:40 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 06:39:40 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 06:38:02 NMAS-9.2.2.0 User account locked due to intruder detection. User: uniqueID=sgciamrt.OU=BusPartners.OU=b2b.OU=ext.OU=people.dc=nationwidedir.dc=extpilot
Feb 11 06:32:21 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=narrong12@utexas\\.edu.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 06:30:03 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=ihrligt.OU=Int.OU=people.dc=nationwidedir.dc=net
Feb 11 06:12:37 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 06:12:37 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 06:08:07 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=firedog3.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 06:06:41 log4cxx: IO Exception : status code = 104
Feb 11 06:06:41 log4cxx: IO Exception : status code = 104
Feb 11 06:06:41 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 06:06:41 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 05:56:07 NMAS-9.2.2.0 User account locked due to intruder detection. User: uniqueID=marvels002@nwie\\.com.OU=BusPartners.OU=b2b.OU=ext.OU=people.dc=nationwidedir.dc=extpilot
Feb 11 05:50:02 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=ihrligt.OU=Int.OU=people.dc=nationwidedir.dc=net
Feb 11 05:49:35 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 05:45:02 log4cxx: IO Exception : status code = 104
Feb 11 05:45:02 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 05:39:43 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 05:39:43 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 05:35:17 log4cxx: IO Exception : status code = 104
Feb 11 05:35:17 log4cxx: IO Exception : status code = 104
Feb 11 05:35:17 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 05:35:17 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 05:10:02 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=ihrligt.OU=Int.OU=people.dc=nationwidedir.dc=net
Feb 11 05:09:05 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=support.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 05:08:39 NMAS-9.2.2.0 User account locked due to intruder detection. User: uniqueID=MFA-RegL_pwR9m7CFCCW.OU=BusPartners.OU=b2b.OU=ext.OU=people.dc=nationwidedir.dc=extpilot
Feb 11 04:55:30 NMAS-9.2.2.0 User account locked due to intruder detection. User: uniqueID=MFA-RegL_pwR9m7CFCCW.OU=BusPartners.OU=b2b.OU=ext.OU=people.dc=nationwidedir.dc=extpilot
Feb 11 04:51:50 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=mattrechs6.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 04:51:44 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=jeanty12@gmail\\.com.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 04:49:22 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=1587yunyulu.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 04:48:35 NMAS-9.2.2.0 User account locked due to intruder detection. User: uniqueID=marvels002@nwie\\.com.OU=BusPartners.OU=b2b.OU=ext.OU=people.dc=nationwidedir.dc=extpilot
Feb 11 04:45:13 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=admin1.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 04:35:02 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 04:30:03 log4cxx: IO Exception : status code = 104
Feb 11 04:30:03 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 04:25:05 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=ihrligt.OU=Int.OU=people.dc=nationwidedir.dc=net
Feb 11 04:17:46 NMAS-9.2.2.0 User account locked due to intruder detection. User: uniqueID=sgciamrt.OU=BusPartners.OU=b2b.OU=ext.OU=people.dc=nationwidedir.dc=extpilot
Feb 11 04:09:36 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=ADMIN.OU=Int.OU=people.dc=nationwidedir.dc=net
Feb 11 03:45:03 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=ihrligt.OU=Int.OU=people.dc=nationwidedir.dc=net
Feb 11 03:41:23 NMAS-9.2.2.0 User account locked due to intruder detection. User: uniqueID=MFA-RegL_pwR9m7CFCCW.OU=BusPartners.OU=b2b.OU=ext.OU=people.dc=nationwidedir.dc=extpilot
Feb 11 03:28:53 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=lasmileysm.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 03:13:47 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=cardo04.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 03:10:08 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=ADMIN.OU=Int.OU=people.dc=nationwidedir.dc=net
Feb 11 03:00:01 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=Medinav.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 02:50:02 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 02:45:02 log4cxx: IO Exception : status code = 104
Feb 11 02:45:02 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 02:36:09 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=everstacie123.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 02:25:17 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=DYGGER81.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 02:25:03 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 02:20:02 log4cxx: IO Exception : status code = 104
Feb 11 02:20:02 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 02:17:41 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 02:15:52 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 02:14:40 log4cxx: IO Exception : status code = 104
Feb 11 02:14:40 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 02:12:30 log4cxx: IO Exception : status code = 104
Feb 11 02:12:30 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 01:59:30 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 01:58:57 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 01:58:42 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 01:56:42 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=dwmillican.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 01:55:02 log4cxx: IO Exception : status code = 104
Feb 11 01:55:02 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 01:55:02 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 01:53:50 log4cxx: IO Exception : status code = 104
Feb 11 01:53:50 log4cxx: IO Exception : status code = 104
Feb 11 01:53:50 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 01:53:50 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 01:50:03 log4cxx: IO Exception : status code = 104
Feb 11 01:50:03 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 01:42:12 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=kjason5557@gmail\\.com.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 01:41:29 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 01:41:29 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 01:33:50 log4cxx: IO Exception : status code = 104
Feb 11 01:33:50 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 01:32:51 log4cxx: IO Exception : status code = 104
Feb 11 01:32:51 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 01:28:54 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=nikolaparan.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 01:23:22 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 01:23:17 NMAS-9.1.4.0 User account locked due to intruder detection. User: uniqueID=bjnoel@live\\.com.OU=MyNW.OU=B2C.OU=Ext.OU=People.dc=nationwidedir.dc=com
Feb 11 01:20:03 log4cxx: IO Exception : status code = 104
Feb 11 01:20:03 log4cxx: Detected problem with TCP connection to infra-logging.nwie.net. All logging will FAIL.
Feb 11 01:19:01 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 01:16:28 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
Feb 11 01:15:02 log4cxx: Connection to TCP host established successfully: infra-logging.nwie.net
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php