(?i)^(Hostd|Vpxa|Rhttpproxy|vmkernel|vmkwarning|vmkdump|healthd|healthdPlugins|hostd-probe|net-cdp|vdtc|envoy-access|fdm|kmxa|sandboxd|vpxd|dcui|crond|ImageConfigManager|sysboot|sfcb|vsanmgmtd)$ vmware ^(?:verbose|info|warning|error|critical|debug) ^(verbose|info|warning|error|critical|debug) status soc_event=dns_ioc event_type=(\S+)(?:.*?src_ip=([\d.]+))? status, srcip soc_event=correlation event_type=(\S+)(?:.*?user="([^"]+)")?(?:.*?src_ip=([\d.]+))? status, srcuser, srcip