use warnings;
use strict;

while (my $match = <DATA>) {
    $match =~ /event="([^(]+).*"/;
    print "$1\n";
}

__DATA__
<ID="user_one" event="open(2)">
<ID="user_one" event="system booted">
<ID="user_one" event="init(1m)">