diff --git a/config/filter.d/oracleims.conf b/config/filter.d/oracleims.conf
index e80d0b96..083702ce 100644
--- a/config/filter.d/oracleims.conf
+++ b/config/filter.d/oracleims.conf
@@ -45,12 +45,14 @@ before = common.conf
 # mi="Bad password"
 # us="01ko8hqnoif09qx0np@imap.opus1.com"
 # di="535 5.7.8 Bad username or password (Authentication failed)."/>
+# Format is generally documented in the PORT_ACCESS mapping 
+# at http://docs.oracle.com/cd/E19563-01/819-4428/bgaur/index.html
 #
 # All that would be on one line.
 # Note that you MUST have LOG_FORMAT=4 for this to work!
 #
 
-failregex = ^.*tr=".*\|.*\|\d+\|<HOST>\|\d+" .+ Bad username or password.*"/>$
+failregex = ^.*tr="[A-Z]+\|[0-9.]+\|\d+\|<HOST>\|\d+" .+ Bad username or password.*"/>$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.