It don't work because of first line in last log you posted.
Learn to take part out and test them,
Learn to take part out and test them,
audi
has no []
and not in same place here. >>> data = "Oct 10 11:42:42 washup20 kernel: [ 0.044121] audit: initializing netlink subsys (disabled)\n" >>> res = data[0].strip().split('[audit] ')[1] Traceback (most recent call last): File "<interactive input>", line 1, in <module> IndexError: list index out of rangeSo what you have done work,or could just add:
except (KeyError, IndexError):