diff --git a/config/filter.d/oracleims.conf b/config/filter.d/oracleims.conf
index 083702ce..e951ff5d 100644
--- a/config/filter.d/oracleims.conf
+++ b/config/filter.d/oracleims.conf
@@ -52,7 +52,7 @@ before = common.conf
 # Note that you MUST have LOG_FORMAT=4 for this to work!
 #
 
-failregex = ^.*tr="[A-Z]+\|[0-9.]+\|\d+\|<HOST>\|\d+" .+ Bad username or password.*"/>$
+failregex = ^.*tr="[A-Z]+\|[0-9.]+\|\d+\|<HOST>\|\d+" ap="[^"]*" mi="Bad password" us="[^"]*" di="535 5.7.8 Bad username or password( \(Authentication failed\))?\."/>$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.