diff --git a/roles/epylog/files/merged/weed_local.cf b/roles/epylog/files/merged/weed_local.cf
index 6b241e86f1..74a9f2fbef 100644
--- a/roles/epylog/files/merged/weed_local.cf
+++ b/roles/epylog/files/merged/weed_local.cf
@@ -271,7 +271,8 @@ sshd.*: Starting session: subsystem 'sftp' for root from 10.5.126.23 port.*
 sshd.*: Corrupted MAC on input.
 sshd.*: pam_systemd(sshd:session): Failed to create session: No such file or directory
 sshd.*: fatal: Write failed: Connection reset by peer
-sshd.*: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
+sshd.*: pam_succeed_if\(sshd:auth\): requirement.*
+sshd.*: pam_unix\(sshd:auth\): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=.*
 sshd.*: PAM .* more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=.*
 stunnel:.*websockets connected remote.*
 stunnel:.*SSL_read.*
@@ -295,7 +296,7 @@ systemd.*: Created slice user-0.slice.
 systemd.*: Removed slice user-0.slice.
 systemd.*: Received SIGRTMIN\+24 from PID.*
 unix_chkpwd.*: account .* has password changed in future
-unix_chkpwd.*: password check failed for user (root)
+unix_chkpwd.*: password check failed for user \(root\)
 userhelper.*: running \'/usr/sbin/mock.*
 groupadd.*: new group.*
 groupadd.*: group added to /etc/g.*