diff --git a/modules/journalwatch.nix b/modules/journalwatch.nix
index 4c65ae0..4db875d 100644
--- a/modules/journalwatch.nix
+++ b/modules/journalwatch.nix
@@ -100,6 +100,7 @@
         filters = ''
           \S+ \S+ \[warn\] [0-9]+#[0-9]+: no resolver defined to resolve r3\.o\.lencr\.org while requesting certificate status, responder: r3\.o\.lencr\.org, certificate: "/etc/nginx/certs/\S+\.crt"
           \S+ \S+ \[error\] [0-9]+#[0-9]+: OCSP responder sent invalid "Content-Type" header: "text/html" while requesting certificate status, responder: r3\.o\.lencr\.org, peer: \S+, certificate: "/etc/nginx/certs/\S+\.crt"
+          \S+ \S+ \[error\] [0-9]+#[0-9]+: \*[0-9]+ connect\(\) failed \(111: Connection refused\) while connecting to upstream, client: \S+, server: \S+, request: "[^"]+", upstream: "[^"]+", host: "[^"]+"
         '';
         match = "CONTAINER_NAME = nginx-proxy";
       }
@@ -118,23 +119,22 @@
         filters = ''
           \S+ \S+ \[error\] [0-9]+#[0-9]+: \S+ open\(\) "/usr/share/nginx/html/robots\.txt" failed \(2: No such file or directory\), client: \S+, server: localhost, request: "GET /robots\.txt HTTP/[^"]+", host: "[^"]+"
           #
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: signal 3 \(SIGQUIT\) received, shutting down
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: gracefully shutting down
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: exiting
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: exit
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: signal 17 \(SIGCHLD\) received from [0-9]+
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: worker process [0-9]+ exited with code 0
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: signal 3 \(SIGQUIT\) received, shutting down
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: gracefully shutting down
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: exiting
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: exit
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: signal 17 \(SIGCHLD\) received from [0-9]+
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: worker process [0-9]+ exited with code 0
           #
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: reconfiguring
-          #
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: using the "epoll" event method
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: nginx/\S+
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: built by gcc \S+ \S+ (Alpine \S+)
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: OS: Linux \S+
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: getrlimit\(RLIMIT_NOFILE\): [0-9]+:[0-9]+
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: start worker processes
-         \S+\S+ \[notice\] [0-9]+#[0-9]+: start worker process [0-9]+
-
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: signal 1 \(SIGHUP\) received, reconfiguring
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: reconfiguring
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: using the "epoll" event method
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: nginx/\S+
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: built by gcc \S+ \S+ (Alpine \S+)
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: OS: Linux \S+
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: getrlimit\(RLIMIT_NOFILE\): [0-9]+:[0-9]+
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: start worker processes
+          \S+\S+ \[notice\] [0-9]+#[0-9]+: start worker process [0-9]+
         '';
         match = "IMAGE_NAME = /nginx:\S+/";
       }
@@ -148,6 +148,8 @@
               [0-9] \[[>-]+\]    [0-9] \[[>-]+\]
               [0-9] \[[>-]+\]
           \[\S+ \S+\] NOTICE: fpm is running, pid [0-9]+
+          \[\S+ \S+\] NOTICE: Finishing \.\.\.
+          \[\S+ \S+\] NOTICE: exiting, bye-bye!
           #
           # 1.1.1.1 -  28/Sep/2023:21:03:39 +0000 "GET /status.php" 200
           # 1.1.1.1 -  28/Sep/2023:21:12:16 +0000 "GET /index.php" 200