From 010e76406fd2aac83b8cf6da27e9d380cc75dad4 Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester" <info@sebres.de>
Date: Mon, 9 Nov 2020 13:19:25 +0100
Subject: [PATCH] small tweaks (both 2nd time and facility are optional, avoid
 catch-all, etc)

---
 config/filter.d/softethervpn.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/softethervpn.conf b/config/filter.d/softethervpn.conf
index 0cbf5c94..f7e7c0c3 100644
--- a/config/filter.d/softethervpn.conf
+++ b/config/filter.d/softethervpn.conf
@@ -6,4 +6,4 @@
 before = common.conf
 
 [Definition]
-failregex = ^%(__prefix_line)s(?:\([0-9 :.-]{23}\) <SECURITY_LOG>:)? Connection ".+": User authentication failed. The user name that has been provided was "<F-USER>.+</F-USER>", from <HOST>.$
+failregex = ^%(__prefix_line)s(?:(?:\([\d\-]+ [\d:.]+\) )?<SECURITY_LOG>: )?Connection "[^"]+": User authentication failed. The user name that has been provided was "<F-USER>(?:[^"]+|.+)</F-USER>", from <ADDR>\.$