diff --git a/config/filter.d/froxlor-auth.conf b/config/filter.d/froxlor-auth.conf
index ab85c9cf..c6f35e15 100644
--- a/config/filter.d/froxlor-auth.conf
+++ b/config/filter.d/froxlor-auth.conf
@@ -20,15 +20,15 @@ before = common.conf
 [DEFAULT]
 _daemon = [Ff]roxlor
 
+_re = (?:Unknown )?[uU]ser(?: '<F-USER>(?:\S*|[^']*)</F-USER>')? tried to login(?: with wrong password)?\.
+
 [type1]
-prefregex = ^%(__prefix_line)s\[Login Action <HOST>\] <F-CONTENT>.+</F-CONTENT>$
+failregex = ^%(__prefix_line)s\[Login Action <ADDR>\] %(_re)s$
 
 [type2]
-prefregex = ^%(__prefix_line)sfroxlor\.WARNING: <F-CONTENT>.+</F-CONTENT> \{(?:"[^"]+":"[^"]*",\s*){,5}"user":"<ADDR>"\} \[\]$
+failregex = ^%(__prefix_line)sfroxlor\.WARNING: %(_re)s \{(?:"[^"]+":"[^"]*",\s*){,5}"user":"<ADDR>"\} \[\]$
 
 [Definition]
 type = 2
-prefregex = <type<type>/prefregex>
-failregex = ^Unknown user(?: <F-USER>\S*</F-USER>)? tried to login\.$
-            ^User(?: <F-USER>\S*</F-USER>)? tried to login with wrong password\.$
+failregex = <type<type>/failregex>
 ignoreregex =