$re = '/changed\sfor:\s\'+(?<changed_filename>\S+[^\'])/m';
$str = 'Apr 17 08:09:45 clap ossec: Alert Level: 7; Rule: 550 - Integrity checksum changed.; Location: clap->syscheck; classification: ossec,syscheck,; Previous MD5: \'0a79ed913a931af0220c0349353ab9ec\'; Current MD5: \'809a2abe99e979b90e9298d3a052a312\'; Previous SHA1: \'814125fb17df21b9a91f8b1f839dac91733f0150\'; Current SHA1: \'3728e27f1f9ab27654ebb72aa6d01219d8624881\'; Size changed: from \'5780\' to \'5950\'; Integrity checksum changed for: \'/home/clapuser/UserDisable/disable.py\'';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php