$: cat x
14-OCT-2012 06:38:59 * (CONNECT_DATA=(SID=test)(GLOBAL_NAME=test.mydb.com.ch)(CID=(PROGRAM=Z:\Ora6i\BIN\ifrun60.EXE)(HOST=8000XXX05004RV)(USER=mickey))) * (ADDRESS=(PROTOCOL=tcp)(HOST=11.90.24.239)(PORT=1552)) * establish * test * 0
14-OCT-2012 06:39:15 * (CONNECT_DATA=(SID=test)(GLOBAL_NAME=test.mydb.com.ch)(CID=(PROGRAM=Z:\Ora6i\BIN\RWRBE60.exe)(HOST=8000XXX05004RV)(USER=mickey))) * (ADDRESS=(PROTOCOL=tcp)(HOST=11.90.24.239)(PORT=1574)) * establish * test * 0
14-OCT-2012 06:40:48 * (CONNECT_DATA=(SID=test)(GLOBAL_NAME=test.mydb.com.ch)(CID=(PROGRAM=Z:\Ora6i\BIN\ifrun60.EXE)(HOST=8200XXX138060Z)(USER=mouse))) * (ADDRESS=(PROTOCOL=tcp)(HOST=11.217.35.94)(PORT=2525)) * establish * test * 0
14-OCT-2012 07:01:04 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=server911)(USER=oracle))(COMMAND=status)(ARGUMENTS=64)(SERVICE=test)(VERSION=135296000)) *
status * 0
$: awk -F'[=|\(|\)]' '{
>  for(i=1;i<NF;i++) {
>   if($i=="PROGRAM") p=$(i+1);
>   if($i=="HOST") h=$(i+1);
>   if($i=="USER") u=$(i+1);
>  }
>  printf "Program: %s Host: %s User: %s\n", p,h,u;
> } ' x
Program:  Host:  User:
Program:  Host:  User:
Program:  Host:  User:
Program:  Host:  User:
Program:  Host:  User:
$:

 
$: awk 'BEGIN { FS="(PROGRAM=" } { print $2 }' x
CONNECT_DATA=
CONNECT_DATA=
CONNECT_DATA=
CONNECT_DATA=