diff --git a/modules/journalwatch.nix b/modules/journalwatch.nix
index 8e39aa5..3e23b14 100644
--- a/modules/journalwatch.nix
+++ b/modules/journalwatch.nix
@@ -120,7 +120,7 @@
         filters = ''
           .*
         '';
-        match = "IMAGE_NAME = /(p1st/docker-gen:.+|nginxproxy/acme-companion|thetorproject/snowflake-proxy:.+|collabora/code|wordpress|danielszabo99/microbin|p1st/mastodon-toot-follower:.+|browserless/chrome|vabene1111/recipes)/";
+        match = "IMAGE_NAME = /(redis:alpine|p1st/docker-gen:.+|nginxproxy/acme-companion|thetorproject/snowflake-proxy:.+|collabora/code|wordpress|danielszabo99/microbin|p1st/mastodon-toot-follower:.+|browserless/chrome|vabene1111/recipes)/";
       }
       { # yodaNas
         filters = ''
@@ -555,11 +555,15 @@
           #
           # Somebody evil ...
           #
+          Failed keyboard-interactive/pam for invalid user \S+ from \S+ port \S+ ssh2
+          Unable to negotiate with \S+ port \S+: no matching MAC found. Their offer: \S+ \[preauth\]
           Invalid user \S+ from \S+ port \S+
           Disconnected from invalid user \S+ \S+ port \S+ \[preauth\]
           Disconnected from authenticating user root \S+ port \S+ \[preauth\]
+          Received disconnect from \S+ port \S+:11: Client disconnecting normally \[preauth\]
           Received disconnect from \S+ port \S+:11: Bye Bye \[preauth\]
           Connection closed by \S+ port \S+ \[preauth\]
+          Connection closed by authenticating user root \S+ port \S+ \[preauth\]
           error: kex_exchange_identification: banner line contains invalid characters
           # error: kex_exchange_identification: client sent invalid protocol identifier "MGLNDD_188.194.209.73_2222"
           # error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1"