in reply to perl substitution difficulty

Of course, if you wanted to avoid this regular expression sillyness altogether, then you could draw upon the power of CPAN.

Parse::Syslog looks like it might be just the ticket.

Cheers,
Darren :)

In Section Seekers of Perl Wisdom