diff --git a/config/filter.d/xrdp.conf b/config/filter.d/xrdp.conf
index c625b496..6937acb8 100644
--- a/config/filter.d/xrdp.conf
+++ b/config/filter.d/xrdp.conf
@@ -25,10 +25,11 @@ _daemon = xrdp-sesman
 
 [Definition]
 
-authfail_re = \[INFO \] AUTHFAIL: user=.+ ip=<HOST> time=\d+
+authfail_re = \[INFO \] AUTHFAIL: user=<F-USER>.+</F-USER> ip=<ADDR> time=\d+
 
 failregex = ^%(__prefix_line)s%(authfail_re)s$
 
 ignoreregex =
 
-
+datepattern = ^\[?%%ExY%%Exm%%Exd[-|T]%%ExH:?%%ExM:?%%ExS(?:[.,]%%f)?(?:\s*%%z)?\]?
+              ^{DATE}