diff --git a/config/filter.d/softethervpn.conf b/config/filter.d/softethervpn.conf
index 0cbf5c94..f7e7c0c3 100644
--- a/config/filter.d/softethervpn.conf
+++ b/config/filter.d/softethervpn.conf
@@ -6,4 +6,4 @@
 before = common.conf
 
 [Definition]
-failregex = ^%(__prefix_line)s(?:\([0-9 :.-]{23}\) <SECURITY_LOG>:)? Connection ".+": User authentication failed. The user name that has been provided was "<F-USER>.+</F-USER>", from <HOST>.$
+failregex = ^%(__prefix_line)s(?:(?:\([\d\-]+ [\d:.]+\) )?<SECURITY_LOG>: )?Connection "[^"]+": User authentication failed. The user name that has been provided was "<F-USER>(?:[^"]+|.+)</F-USER>", from <ADDR>\.$