using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"<EventTypeCode csd-code=\""(?<myEventTypeCode>PPQ-1)\"".+?<ActiveParticipant UserID=\""(?<myUserID>\w{0,})\"" UserName=\""(?<myUserName>[^\""]*)\"" UserIsRequestor=\""true\"".*?<RoleIDCode csd-code=\""(?<myRoleCode>\w{1,})\"".+?<AuditSourceIdentification.+?AuditSourceID=\""(?<myAuditSourceID>.+?)\"">.+?<ParticipantObjectIdentification ParticipantObjectID=\""(?<myParticipantObjectID>\d{1,})[^\""]+?2\.16\.756\.5\.30\.1\.127.+?\"" ParticipantObjectTypeCode=\""1\"" ParticipantObjectTypeCodeRole=\""1\"">";
string input = @"type=SYSCALL msg=audit(1603788735.462:431935): arch=c000003e syscall=2 success=yes exit=34 a0=1d08f80 a1=80042 a2=1a4 a3=1d08f80 items=2 ppid=1 pid=19277 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=""rhn_check"" exe=""/usr/bin/python2.7"" subj=system_u:system_r:rpm_t:s0 key=""audit_rules_etc_modification""";
RegexOptions options = RegexOptions.Singleline;
foreach (Match m in Regex.Matches(input, pattern, options))
{
Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index);
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx