$re = '/^.*IMAP Error: Login failed for .* from (?P<host>.*)\. AUTHENTICATE PLAIN: Authentication failed\. in .* \(POST .*\)$/m';
$str = '[16-Sep-2016 17:48:15 +0200]: <r24n59kn> IMAP Error: Login failed for ssdfsdf from 213.97.11.31. AUTHENTICATE PLAIN: Authentication failed. in /usr/share/roundcube/program/lib/Roundcube/rcube_imap.php on line 197 (POST /?_task=login?_task=login&_action=login)
[16-Sep-2016 17:48:28 +0200]: <r24n59kn> IMAP Error: Login failed for ssdfsdf from 213.97.11.31. AUTHENTICATE PLAIN: Authentication failed. in /usr/share/roundcube/program/lib/Roundcube/rcube_imap.php on line 197 (POST /?_task=login?_task=login&_action=login)
[16-Sep-2016 17:48:47 +0200]: <r24n59kn> IMAP Error: Login failed for sdfgsdfgsdfg from 213.97.11.31. AUTHENTICATE PLAIN: Authentication failed. in /usr/share/roundcube/program/lib/Roundcube/rcube_imap.php on line 197 (POST /?_task=login?_task=login&_action=login)
[16-Sep-2016 17:49:12 +0200]: <r24n59kn> IMAP Error: Login failed for sdfgsdfgsdfg from 213.97.11.31. AUTHENTICATE PLAIN: Authentication failed. in /usr/share/roundcube/program/lib/Roundcube/rcube_imap.php on line 197 (POST /?_task=login?_task=login&_action=login)
[16-Sep-2016 17:49:39 +0200]: <r24n59kn> IMAP Error: Login failed for sdfgsdfgsdfg from 213.97.11.31. AUTHENTICATE PLAIN: Authentication failed. in /usr/share/roundcube/program/lib/Roundcube/rcube_imap.php on line 197 (POST /?_task=login?_task=login&_action=login)
[16-Sep-2016 17:50:23 +0200]: <r24n59kn> IMAP Error: Login failed for sdfgsdfgsdfg from 213.97.11.31. AUTHENTICATE PLAIN: Authentication failed. in /usr/share/roundcube/program/lib/Roundcube/rcube_imap.php on line 197 (POST /?_task=login?_task=login&_action=login)';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php