#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?s)<EventTypeCode csd-code=\"(?<myEventTypeCode>PPQ-1)\".+?<ActiveParticipant UserID=\"(?<myUserID>\w{0,})\" UserName=\"(?<myUserName>[^\"]*)\" UserIsRequestor=\"true\".*?<RoleIDCode csd-code=\"(?<myRoleCode>\w{1,})\".+?<AuditSourceIdentification.+?AuditSourceID=\"(?<myAuditSourceID>.+?)\">.+?<ParticipantObjectIdentification ParticipantObjectID=\"(?<myParticipantObjectID>\d{1,})[^\"]+?2\.16\.756\.5\.30\.1\.127.+?\" ParticipantObjectTypeCode=\"1\" ParticipantObjectTypeCodeRole=\"1\">"
Local $sString = "type=SYSCALL msg=audit(1603788735.462:431935): arch=c000003e syscall=2 success=yes exit=34 a0=1d08f80 a1=80042 a2=1a4 a3=1d08f80 items=2 ppid=1 pid=19277 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rhn_check" exe="/usr/bin/python2.7" subj=system_u:system_r:rpm_t:s0 key="audit_rules_etc_modification""
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm