use warnings;
use strict;

while (my $line = <DATA>) {
    while ($line =~ m/event="([^("]+)[^"]*"/gi) {
        print "$1\n";
    }
}

__DATA__
<ID="user_one" event="open(2)">
<ID="user_one" event="system booted">
<ID="user_one" event="system booted"><ID="user_one" EVENT="init(1m)">
<ID="user_one" event="init(1m)">
<ID="" event="">