For fun.
$s = 'Aug 1 12:12:12 host [login=name, pid=1356] -> sh [args: "sh", "-
+c", "ls -l", "/var/log"]';
$s =~ m{\[args:\s+"(.*)"\]} and @args = split '",\s+"', $1;
print $_, $/ for @args;
sh
-c
ls -l
/var/log
Examine what is said, not who speaks.
"Efficiency is intelligent laziness." -David Dunham
"When I'm working on a problem, I never think about beauty. I think only how to solve the problem. But when I have finished, if the solution is not beautiful, I know it is wrong." -Richard Buckminster Fuller
If I understand your problem, I can solve it! Of course, the same can be said for you.