package main
import (
"regexp"
"fmt"
)
func main() {
var re = regexp.MustCompile(`(?s)<EventTypeCode csd-code=\"(?<myEventTypeCode>PPQ-1)\".+?<ActiveParticipant UserID=\"(?<myUserID>\w{0,})\" UserName=\"(?<myUserName>[^\"]*)\" UserIsRequestor=\"true\".*?<RoleIDCode csd-code=\"(?<myRoleCode>\w{1,})\".+?<AuditSourceIdentification.+?AuditSourceID=\"(?<myAuditSourceID>.+?)\">.+?<ParticipantObjectIdentification ParticipantObjectID=\"(?<myParticipantObjectID>\d{1,})[^\"]+?2\.16\.756\.5\.30\.1\.127.+?\" ParticipantObjectTypeCode=\"1\" ParticipantObjectTypeCodeRole=\"1\">`)
var str = `type=SYSCALL msg=audit(1603788735.462:431935): arch=c000003e syscall=2 success=yes exit=34 a0=1d08f80 a1=80042 a2=1a4 a3=1d08f80 items=2 ppid=1 pid=19277 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rhn_check" exe="/usr/bin/python2.7" subj=system_u:system_r:rpm_t:s0 key="audit_rules_etc_modification"`
for i, match := range re.FindAllString(str, -1) {
fmt.Println(match, "found at index", i)
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Golang, please visit: https://golang.org/pkg/regexp/