$s = 'Aug 1 12:12:12 host [login=name, pid=1356] -> sh [args: "sh", "-c", "ls -l", "/var/log"]';
$s =~ m{\[args:\s+"(.*)"\]} and @args = split '",\s+"', $1; 
print $_, $/ for @args;

sh
-c
ls -l
/var/log