$re = '/<AUDT:INFO>.* Passwordstate:/m';
$str = '08 21 2020 08:15:25 10.72.1.17 <AUDT:INFO> 2020-08-21 08:14:25 10.72.1.17 Passwordstate: Fake User (fakedoamin\\FakeUser) initiated a Remote Session connection to Host \'fakeserver.fakedomain.tld\' using the manual credentials of \'FakeUser\'.Fake User (fakedoamin\\FakeUser) initiated a Remote Session connection to Host \'fakeserver.fakedomain.tld\' using the manual credentials of \'FakeUser\'. Reason = Task 31117 Checking GPT files Client IP Address = 10.14.72.232';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php