Update filter again

Sorry to edit this again.  The format of the messages in the logs is highly variable, and the addition suggested will cause problems.  There are 16 separate "LOG_" options which can be turned on and off, and there's no guarantee which a system manager will have.  This regex matches the "minimum" requirement to catch this authentication failure, which is the LOG_CONNECTION having bit 5 set (this forces the "tr" to be present).
Other fields in the regex that were proposed in the prior edit may or may NOT be present depending on the other 15+ LOG_ options.  The "Bad username or password" string is guaranteed to be there (in an auth failure), but the mi= field won't be there unless LOG_MESSAGE_ID is set, and that may not be so.  SImilarly, the "us=" and "ap=" fields may or may not be there or there could be other fields in the way.  

I think that this is the minimum regex which will work for most configurations where LOG_FORMAT is set to XML (common) and LOG_CONNECTION has bit 5 on.