diff --git a/roles/epylog/files/merged/weed_local.cf b/roles/epylog/files/merged/weed_local.cf
index c21a1404e9..6b241e86f1 100644
--- a/roles/epylog/files/merged/weed_local.cf
+++ b/roles/epylog/files/merged/weed_local.cf
@@ -271,6 +271,8 @@ sshd.*: Starting session: subsystem 'sftp' for root from 10.5.126.23 port.*
 sshd.*: Corrupted MAC on input.
 sshd.*: pam_systemd(sshd:session): Failed to create session: No such file or directory
 sshd.*: fatal: Write failed: Connection reset by peer
+sshd.*: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
+sshd.*: PAM .* more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=.*
 stunnel:.*websockets connected remote.*
 stunnel:.*SSL_read.*
 stunnel:.*Connection reset.*
@@ -293,6 +295,7 @@ systemd.*: Created slice user-0.slice.
 systemd.*: Removed slice user-0.slice.
 systemd.*: Received SIGRTMIN\+24 from PID.*
 unix_chkpwd.*: account .* has password changed in future
+unix_chkpwd.*: password check failed for user (root)
 userhelper.*: running \'/usr/sbin/mock.*
 groupadd.*: new group.*
 groupadd.*: group added to /etc/g.*