$re = '/\b\((.*?)\)|\buid=(\w+)|\bname=(.*?)\s/';
$str = 'type=SYSCALL msg=audit(24/03/17 09:15:51.570:13045) : arch=x86_64 syscall=unlink success=yes exit=0 a0=0x563dbbd69762 a1=0x7f6e46b32e15 a2=0x0 a3=0x563dbbc07a00 items=2 ppid=1670 pid=2247 auid=unset uid=stacksmasher gid=stacksmasher euid=stacksmasher suid=stacksmasher fsuid=stacksmasher egid=stacksmasher sgid=stacksmasher fsgid=stacksmasher tty=(none) ses=unset comm=mate-session exe=/usr/bin/mate-session key=sinkingeye
type=PATH msg=audit(24/03/17 09:15:51.854:13138) : item=1 name=/tmp/.X0-lock inode=8519683 dev=08:01 mode=file,444 ouid=root ogid=root rdev=00:00 nametype=DELETE
type=PATH msg=audit(24/03/17 09:15:51.854:13138) : item=0 name=/tmp/ inode=8519681 dev=08:01 mode=dir,sticky,777 ouid=root ogid=root rdev=00:00 nametype=PARENT';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php