$re = '/<AUDT:INFO>.(?<date>\d+.\d+.\d+) (?:\d+:\d+:\d+) (?<dip>\d+.\d+.\d+.\d+) (?:.*(?<subject>Successful Active Directory login)(?:.\w+.\w+)(?<account>.*?\W))\w+.\w+.\w+.\w+.\'(?<sip>.\d+.\d+.\d+.\d+)\'.*$/m';
$str = '08 21 2020 08:32:25 10.72.1.17 <AUDT:INFO> 2020-08-21 08:31:58 10.72.1.17 Passwordstate: Successful Active Directory login for UserID \'fakedoamin\\FakeUser\' from the IP Address \'10.72.1.17\'. Client IP Address = 10.72.1.93
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php