user_alert.conf limited regex

Hello,

It seems regex in user_alert.conf are limited but I didn't find any good documentation.

I would like a script to be executed with this log line:

Aug 27 09:03:42 xxxxxxxx.mgt.xxxxxxxx.corp notice tmm2[26043]: 01490549:5: /Common/xxxxxxxx_policy:Common:eb1a58a1: Assigned PPP Dynamic IPv4: 100.100.100.100 ID: d60f8480 Tunnel Type: VPN_TUNNELTYPE_DTLS NA Resource: /Common/Network_xxxxxx Client IP: 100.100.100.200

But not with:

Aug 27 09:03:42 xxxxxxxx.mgt.xxxxxxxx.corp notice tmm2[26043]: 01490549:5: /Common/xxxxxxxx_policy:Common:eb1a58a1: Assigned PPP Dynamic IPv4: 100.100.100.100 ID: d60f8480 Tunnel Type: VPN_TUNNELTYPE_DTLS NA Resource: /Common/Network_xxxxxx Client IP: 100.100.100.200 - Reconnect

This line takes both but works:

alert log_username_vpn_ip "Assigned PPP Dynamic IPv4" {
    exec command="/shared/scripts/xxxxxxxxxxx.sh"
}

These two should work but make alertd restarting over and over:

alert log_username_vpn_ip "Assigned PPP Dynamic IPv4.*\d$" {
    exec command="/shared/scripts/xxxxxxxxxxx.sh"
}

alert log_username_vpn_ip "Assigned PPP Dynamic IPv4.*\d(?!.*Reconnect)" {
    exec command="/shared/scripts/log_username_vpn_ip_logon.sh"
}

Any idea?