m/(\w+\.(2048|512)).*renewed|revoked/
[download]

is similar to

m/(\w+\.(2048|512)).*renewed/ or m/revoked/
[download]

because of the precedence of the vertical bar. You want (I think):

m/(\w+\.(2048|512)).*(renewed|revoked)/
[download]

-- Randal L. Schwartz, Perl hacker