Сон разума или сок мозга - Регулярные выражения и с чем их едят

AV\s-\sAlert\s-\s\"(?P<date>\d+)\"\s--\>\sRID\:\s\"800000\".*?HOSTNAME\:\s\".*?\s(?P<device>.*?)\-.*?INIT\](?P<log>.*?ACTION\s*\:\s+\'(?P<action>(superuserlogon|SUPERUSERLOGON|superuserddl|SUPERUSERDDL|superuserdml|SUPERUSERDML|startup|STARTUP|shutdown|SHUTDOWN|superuserunknown|SUPERUSERUNKNOWN|factorevaluation|FACTOREVALUATION|factorassignment|FACTORASSIGNMENT|factorexpression|FACTOREXPRESSION|realmviolation|REALMVIOLATION|realmauthorization|REALMAUTHORIZATION|commandauthorization|COMMANDAUTHORIZATION|securerole|SECUREROLE|lblsecsessioninit|LBLSECSESSIONINIT|accessctrlcommandauth|ACCESSCTRLCOMMANDAUTH|accessctrlsessioninit|ACCESSCTRLSESSIONINIT|lblsecattempttoupgrade|LBLSECATTEMPTTOUPGRADE|connect|CONNECT|invalidrecord|INVALIDRECORD|alter|ALTER|create|CREATE|drop|DROP|dropdimension|DROPDIMENSION|createcontext|CREATECONTEXT|dropcontext|DROPCONTEXT|alteroutline|ALTEROUTLINE|createoutline|CREATEOUTLINE|dropoutline|DROPOUTLINE|updateindexes|UPDATEINDEXES|alteroperator|ALTEROPERATOR|purgeuser_recyclebin|PURGEUSER_RECYCLEBIN|purgedba_recyclebin|PURGEDBA_RECYCLEBIN|purgetablespace|PURGETABLESPACE|purgetable|PURGETABLE|purgeindex|PURGEINDEX|undropobject|UNDROPOBJECT|flashbackdatabase|FLASHBACKDATABASE|flashbacktable|FLASHBACKTABLE|createrestorepoint|CREATERESTOREPOINT|droprestorepoint|DROPRESTOREPOINT|proxyauthenticationonly|PROXYAUTHENTICATIONONLY|declarerewriteequivalence|DECLAREREWRITEEQUIVALENCE|alterrewriteequivalence|ALTERREWRITEEQUIVALENCE|droprewriteequivalence|DROPREWRITEEQUIVALENCE|networkerror|NETWORKERROR|executetype|EXECUTETYPE|flashback|FLASHBACK|createsession|CREATESESSION|createdirectory|CREATEDIRECTORY|dropdirectory|DROPDIRECTORY|createlibrary|CREATELIBRARY|createjava|CREATEJAVA|alterjava|ALTERJAVA|dropjava|DROPJAVA|createoperator|CREATEOPERATOR|createindextype|CREATEINDEXTYPE|dropindextype|DROPINDEXTYPE|dropoperator|DROPOPERATOR|associatestatistics|ASSOCIATESTATISTICS|disassociatestatistics|DISASSOCIATESTATISTICS|callmethod|CALLMETHOD|createsummary|CREATESUMMARY|altersummary|ALTERSUMMARY|dropsummary|DROPSUMMARY|createdimension|CREATEDIMENSION|alterdimension|ALTERDIMENSION|logon|LOGON|logoff|LOGOFF|logoffbycleanup|LOGOFFBYCLEANUP|sessionrec|SESSIONREC|systemaudit|SYSTEMAUDIT|systemnoaudit|SYSTEMNOAUDIT|auditdefault|AUDITDEFAULT|noauditdefault|NOAUDITDEFAULT|systemgrant|SYSTEMGRANT|systemrevoke|SYSTEMREVOKE|createpublicsynonym|CREATEPUBLICSYNONYM|droppublicsynonym|DROPPUBLICSYNONYM|createpublicdatabaselink|CREATEPUBLICDATABASELINK|droppublicdatabaselink|DROPPUBLICDATABASELINK|grantrole|GRANTROLE|revokerole|REVOKEROLE|executeprocedure|EXECUTEPROCEDURE|usercomment|USERCOMMENT|enabletrigger|ENABLETRIGGER|disabletrigger|DISABLETRIGGER|enablealltriggers|ENABLEALLTRIGGERS|disablealltriggers|DISABLEALLTRIGGERS|creatematerializedview|CREATEMATERIALIZEDVIEW|altermaterializedview|ALTERMATERIALIZEDVIEW|dropmaterializedview|DROPMATERIALIZEDVIEW|createtype|CREATETYPE|droptype|DROPTYPE|alterrole|ALTERROLE|altertype|ALTERTYPE|createtypebody|CREATETYPEBODY|altertypebody|ALTERTYPEBODY|droptypebody|DROPTYPEBODY|droplibrary|DROPLIBRARY|truncatetable|TRUNCATETABLE|truncatecluster|TRUNCATECLUSTER|createfunction|CREATEFUNCTION|alterfunction|ALTERFUNCTION|dropfunction|DROPFUNCTION|createpackage|CREATEPACKAGE|alterpackage|ALTERPACKAGE|droppackage|DROPPACKAGE|createpackagebody|CREATEPACKAGEBODY|alterpackagebody|ALTERPACKAGEBODY|droppackagebody|DROPPACKAGEBODY|explain|EXPLAIN|createuser|CREATEUSER|createrole|CREATEROLE|dropuser|DROPUSER|droprole|DROPROLE|setrole|SETROLE|createschema|CREATESCHEMA|createcontrolfile|CREATECONTROLFILE|createtrigger|CREATETRIGGER|altertrigger|ALTERTRIGGER|droptrigger|DROPTRIGGER|analyzetable|ANALYZETABLE|analyzeindex|ANALYZEINDEX|analyzecluster|ANALYZECLUSTER|createprofile|CREATEPROFILE|dropprofile|DROPPROFILE|alterprofile|ALTERPROFILE|dropprocedure|DROPPROCEDURE|alterresourcecost|ALTERRESOURCECOST|creatematerializedviewlog|CREATEMATERIALIZEDVIEWLOG|altermaterializedviewlog|ALTERMATERIALIZEDVIEWLOG|dropmaterializedviewlog|DROPMATERIALIZEDVIEWLOG|rename|RENAME|comment|COMMENT|auditobject|AUDITOBJECT|noauditobject|NOAUDITOBJECT|createdatabaselink|CREATEDATABASELINK|dropdatabaselink|DROPDATABASELINK|createdatabase|CREATEDATABASE|alterdatabase|ALTERDATABASE|createrollbackseg|CREATEROLLBACKSEG|alterrollbackseg|ALTERROLLBACKSEG|droprollbackseg|DROPROLLBACKSEG|createtablespace|CREATETABLESPACE|altertablespace|ALTERTABLESPACE|droptablespace|DROPTABLESPACE|altersession|ALTERSESSION|alteruser|ALTERUSER|commit|COMMIT|rollback|ROLLBACK|savepoint|SAVEPOINT|pl\\\/sqlexecute|PL\\\/SQLEXECUTE|settransaction|SETTRANSACTION|altersystem|ALTERSYSTEM|update|UPDATE|delete|DELETE|dropcluster|DROPCLUSTER|createindex|CREATEINDEX|dropindex|DROPINDEX|alterindex|ALTERINDEX|droptable|DROPTABLE|createsequence|CREATESEQUENCE|altersequence|ALTERSEQUENCE|altertable|ALTERTABLE|dropsequence|DROPSEQUENCE|grantobject|GRANTOBJECT|revokeobject|REVOKEOBJECT|createsynonym|CREATESYNONYM|dropsynonym|DROPSYNONYM|createview|CREATEVIEW|dropview|DROPVIEW|validateindex|VALIDATEINDEX|createprocedure|CREATEPROCEDURE|alterprocedure|ALTERPROCEDURE|lock|LOCK|no-op|NO-OP|createtable|CREATETABLE|insert|INSERT|select|SELECT|createcluster|CREATECLUSTER|altercluster|ALTERCLUSTER)).*?\'\sDATABASE\sUSER\:\s\'(?P<dbuser>\S+)\'\s.*?CLIENT\sUSER\:\s(?P<domain>\S+)\\(?P<username>.*?)\sCLIENT\sTERMINAL\:\s(?P<srcip>\S+)\sSTATUS\:\s(?P<status>\d+).*?)\[END\]\";