Hi Rob!
Taking this event as example:
Dec 02 15:34:04 2013 hub-pila-0005 %%10SHELL/5/CMD(l):- 1 -task:vt0 ip:10.223.168.132 user:sistemas command:display ver
So..
%%10SHELL/5/CMD(l): (?P<component>\S+)-\d-\S+)
task:vt0 ip:10.223.168.132 user:sistemas command:display ver (?P<summary>.*)
Zenoss usually spects and space between them but in this case there is a "- 1 -", this is unit id (this id is from device itself, nothing to do with zenoss), hub-pila-0005 is device´s name.
Thanks!