diff --git a/roles/epylog/files/merged/weed_local.cf b/roles/epylog/files/merged/weed_local.cf
index 571f456b4a..22b2c5e406 100644
--- a/roles/epylog/files/merged/weed_local.cf
+++ b/roles/epylog/files/merged/weed_local.cf
@@ -260,6 +260,7 @@ spamd.*: spamd: server pid.*
 spamd.*: spamd: server started.*
 spamd.*: spamd: server successfully.*
 spamd.* spamd: setuid to.*
+sshd.*: message repeated.*Starting session.*
 sshd.*: Address.*maps to.*but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT.*
 sshd.*: Did not receive identification.*
 sshd.*: Disconnecting: Too many authentication failures for root.*
@@ -267,9 +268,10 @@ sshd.*: error: connect_to
 sshd.*: error: ssh_selinux_setup_pty:
 sshd.*: Found matching RSA key.*
 sshd.*: Found matching DSA key.*
+sshd.*: Found matching ED25519 key.*
 sshd.*: input_userauth_request: invalid user.*
 sshd.*: pam_unix\(sshd:session\): session closed for user.*
-sshd.*: Close session: user root from.*
+sshd.*: Close session.*
 sshd.*: pam_unix\(sshd:session\): session opened for user.*
 sshd.*: Postponed publickey for.*
 sshd.*: refused connect from.*