my $message = 'Mar  3 11:29:11 10.20.20.2 8194 03/03/2003 13:15:37.330 SEV=5 AUTH/36 RPT=29  User [ admin ] Protocol [ Telnet ] attempted ADMIN logon.. Status: <ACCESS GRANTED> !';
my ($user) = $message =~ /\[\s+(\w+)\s+\]/;
print $user,$/;