$re = '/^(\w{3}\s*\d)\s*(\d\d:\d\d:\d\d)\s*(\w+)/m';
$str = 'Aug 1 18:27:49 knight sshd[20327]: Failed password for illegal user guest from 218.49.183.17 port 49090 ssh2
Aug 1 18:27:49 knight sshd[20327]: error: Could not get shadow information for NOUSER
Aug 1 18:27:52 knight sshd[20329]: Failed password for admin from 218.49.183.17 port 49266 ssh2
Aug 1 18:27:56 knight sshd[20331]: Failed password for admin from 218.49.183.17 port 49468 ssh2
Aug 1 18:27:58 knight sshd[20334]: Illegal user user from 218.49.183.17
Aug 1 18:27:59 knight sshd[20334]: Failed password for illegal user user from 218.49.183.17 port 49680 ssh2
Aug 1 18:27:59 knight sshd[20334]: error: Could not get shadow information for NOUSER
Aug 1 18:28:02 knight sshd[20336]: Failed password for root from 218.49.183.17 port 49869 ssh2
Aug 1 18:28:05 knight sshd[20347]: Failed password for root from 218.49.183.17 port 50063 ssh2
Aug 1 18:28:12 knight sshd[20349]: Failed password for root from 218.49.183.17 port 50245 ssh2
Aug 1 18:28:14 knight sshd[20352]: Illegal user test from 218.49.183.17
Aug 1 18:28:19 knight sshd[20352]: Failed password for illegal user test from 218.49.183.17 port 50671 ssh2
Aug 1 18:28:19 knight sshd[20352]: error: Could not get shadow information for NOUSER
Aug 1 18:29:55 knight sshd[20402]: Illegal user test from 218.49.183.17
Aug 1 18:29:56 knight sshd[20402]: Failed password for illegal user test from 218.49.183.17 port 52244 ssh2
Aug 1 18:29:56 knight sshd[20402]: error: Could not get shadow information for NOUSER
Aug 1 18:29:58 knight sshd[20404]: Illegal user guest from 218.49.183.17
Aug 1 18:30:02 knight sshd[20406]: Illegal user test from 218.49.183.17
Aug 1 18:30:03 knight sshd[20404]: Failed password for illegal user guest from 218.49.183.17 port 52416 ssh2
Aug 1 18:30:03 knight sshd[20404]: error: Could not get shadow information for NOUSER
Aug 1 18:30:03 knight sshd[20406]: Failed password for illegal user test from 218.49.183.17 port 52558 ssh2
Aug 1 18:30:03 knight sshd[20406]: error: Could not get shadow information for NOUSER
Aug 1 18:30:05 knight sshd[20439]: Failed password for illegal user guest from 218.49.183.17 port 52818 ssh2
Aug 1 18:30:05 knight sshd[20439]: Illegal user guest from 218.49.183.17
Aug 1 18:30:05 knight sshd[20439]: error: Could not get shadow information for NOUSER
Aug 1 18:30:06 knight sshd[20441]: Failed password for admin from 218.49.183.17 port 52851 ssh2
Aug 1 18:30:08 knight sshd[20443]: Failed password for admin from 218.49.183.17 port 53014 ssh2
Aug 1 18:30:09 knight sshd[20445]: Failed password for admin from 218.49.183.17 port 53040 ssh2
Aug 1 18:30:11 knight sshd[20447]: Failed password for admin from 218.49.183.17 port 53192 ssh2';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php