diff --git a/roles/epylog/files/merged/weed_local.cf b/roles/epylog/files/merged/weed_local.cf
index 1ab4533c05..a3ff91d698 100644
--- a/roles/epylog/files/merged/weed_local.cf
+++ b/roles/epylog/files/merged/weed_local.cf
@@ -84,7 +84,7 @@ groupadd.*: group added to.*: name=(mockbuild|dialout|floppy|cdrom|tape|utmp|ute
 heartbeat.* info:.*
 heartbeat.*:info.*
 heartbeat.*:WARN: Gmain_timeout_dispatch: Dispatch function for retransmit request took too long to execute.*
-httpd:.*AH0.*
+httpd.*:.*AH0.*
 in.tftpd.*: tftp: client does not accept options
 journal: libvirt version.*
 journal: Failed to acquire.*
@@ -269,8 +269,8 @@ Rootkit Hunter: Rootkit hunter.*
 Rootkit Hunter: Scanning.*
 rdbsync.*
 root: time debug:.*
-rkhunter: Rootkit hunter check started.*
-rkhunter: Scanning took.*
+rkhunter.*: Rootkit hunter check started.*
+rkhunter.*: Scanning took.*
 registry.*
 rpc.idmapd.*: nss_getpwnam: name.*apache.*
 rpc.idmapd.*: nss_getpwnam: name.*masher.*
@@ -364,6 +364,8 @@ sshd.*: error: key_from_blob: can't parse cert data
 sshd.*: error: Could not load host certificate: /etc/ssh/ssh_host_rsa_key-cert.pub
 sshd.*: pam_systemd\(sshd:session\): Failed to create session: Failed to activate service 'org.freedesktop.login1': timed out.*
 sshd.*: Nasty PTR record.*
+sshd.*: Disconnecting: Change of username or service not allowed.*
+sshd.*: Unable to negotiate with.*
 stunnel.*:.*
 su: pam_unix\(su-l:session\): session .* for user.*
 runuser: pam_unix\(runuser-l:session\).* session opened for user postgres by.*
@@ -382,18 +384,18 @@ systemd.*: Created slice user-.*.slice.
 systemd: Removed slice User Slice of.*
 systemd: Created slice User Slice of.*
 systemd: Listening on D-Bus User Message Bus Socket.
-systemd.*: Removed slice user-.*slice.
+systemd.*: Removed slice User-.*
 systemd.*: Received SIGRTMIN\+24 from PID.*
 systemd.*: Failed to mark scope session-.*.scope as abandoned : Stale file handle
 systemd.*: Failed to reset devices.list on /machine.slice: Invalid argument
 systemd: tmp.mount.*
 systemd: Unit git.*
-systemd-coredump:.*
-systemd-machined:.*
+systemd-coredump.*:.*
+systemd-machined.*:.*
 systemd: Configuration file.*is marked world-inaccessible.*
-systemd: Reload.*
-systemd: Closed D-Bus User Message Bus Socket.
-systemd: Removed slice User Slice of root.
+systemd.*: Reload.*
+systemd.*: Closed D-Bus User Message Bus Socket.
+systemd.*: Removed slice User Slice of root.
 systemd.*: Starting user-0.slice.
 systemd.*: Started Session.*of user root.
 systemd.*: Starting Session.*of user root.
@@ -415,6 +417,7 @@ systemd.*: Starting D-Bus User Message Bus Socket.
 systemd.*: Listening on D-Bus User Message Bus Socket.
 systemd.*: Startup finished in.*
 systemd.*: Started User Manager for UID.*
+systemd.*: Started Process Core Dump
 supybot.*
 twistd.*
 unix_chkpwd.*: account .* has password changed in future