+)\s+logon\s+ Login\s+(succeeded|failed)\s+for\s+user\s+ \'([^']+?)\'\.(.*)}ix){ my ($time, $status, $user, $trusted) = ($1, $2, $3, $4); my $conn = ($trusted .