Okay, there is still a problem. There are two versions of the "new" message coming in, one of them works with the regex one of them does not:

$VAR2 = 7965744 04/13/2004 08:55:23.410 SEV=4 AUTH/22 RPT=1617
 User [arug01] Group [cisco3015] connected, Session Type: IPSec

$VAR2 = 7973668 04/13/2004 08:58:22.630 SEV=4 AUTH/22 RPT=1618
User [192.128.133.41] Group [192.128.133.41] connected, Session Type: 
+IPSec/LAN-to-LAN
[download]

Notice the lack of a space in front of User in the second example. Here is the regex I am using currently, can you suggest modifications. (I am taking these apart to learn them better as I get responses so I hope not to ask same stupid question twice.