diff --git a/modules/journalwatch.nix b/modules/journalwatch.nix
index 9b7146d..bd6ff98 100644
--- a/modules/journalwatch.nix
+++ b/modules/journalwatch.nix
@@ -115,7 +115,25 @@
       }
       { # yodaNas
         filters = ''
-          \S+ \S+ [error] \S+: \S+ open\(\) "/usr/share/nginx/html/robots.txt" failed \(2: No such file or directory\), client: \S+, server: localhost, request: "GET /robots.txt HTTP/[^"]+", host: "[^"]+"
+          \S+ \S+ \[error\] [0-9]+#[0-9]+: \S+ open\(\) "/usr/share/nginx/html/robots\.txt" failed \(2: No such file or directory\), client: \S+, server: localhost, request: "GET /robots\.txt HTTP/[^"]+", host: "[^"]+"
+          #
+          S+ S+ \[notice\] [0-9]+#[0-9]+: signal 3 \(SIGQUIT\) received, shutting down
+          S+ S+ \[notice\] [0-9]+#[0-9]+: gracefully shutting down
+          S+ S+ \[notice\] [0-9]+#[0-9]+: exiting
+          S+ S+ \[notice\] [0-9]+#[0-9]+: exit
+          S+ S+ \[notice\] [0-9]+#[0-9]+: signal 17 \(SIGCHLD\) received from [0-9]+
+          S+ S+ \[notice\] [0-9]+#[0-9]+: worker process [0-9]+ exited with code 0
+          #
+          S+ S+ \[notice\] [0-9]+#[0-9]+: reconfiguring
+          #
+          S+ S+ \[notice\] [0-9]+#[0-9]+: using the "epoll" event method
+          S+ S+ \[notice\] [0-9]+#[0-9]+: nginx/\S+
+          S+ S+ \[notice\] [0-9]+#[0-9]+: built by gcc \S+ \S+ (Alpine \S+)
+          S+ S+ \[notice\] [0-9]+#[0-9]+: OS: Linux \S+
+          S+ S+ \[notice\] [0-9]+#[0-9]+: getrlimit\(RLIMIT_NOFILE\): [0-9]+:[0-9]+
+          S+ S+ \[notice\] [0-9]+#[0-9]+: start worker processes
+          S+ S+ \[notice\] [0-9]+#[0-9]+: start worker process [0-9]+
+
         '';
         match = "IMAGE_NAME = /nginx:\S+/";
       }
@@ -123,7 +141,13 @@
         # TODO: logged IP is not the public one, but always 172.24.0.6
         filters = ''
           Could not yet connect with DB\. Retrying in 10s \.\.\.
+          Nextcloud or one of the apps require upgrade - only a limited number of commands are available
+          You may use your browser or the occ upgrade command to do the upgrade
+          \[\S+ \S+\] NOTICE: ready to handle connections
               [0-9] \[[>-]+\]    [0-9] \[[>-]+\]
+              [0-9] \[[>-]+\]
+          \[\S+ \S+\] NOTICE: fpm is running, pid [0-9]+
+          #
           # 1.1.1.1 -  28/Sep/2023:21:03:39 +0000 "GET /status.php" 200
           # 1.1.1.1 -  28/Sep/2023:21:12:16 +0000 "GET /index.php" 200
           # 1.1.1.1 - my-username 28/Sep/2023:21:20:16 +0000 "DELETE /index.php" 200
@@ -132,7 +156,7 @@
           [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ - \S* \S+ \+0000 "(DELETE|GET|HEAD|MKCOL|MOVE|OPTIONS|POST|PROPFIND|PUT|REPORT) /remote\.php" (200|201|204|207|401|404|405)
           # 1.1.1.1 - my-username 28/Sep/2023:21:11:48 +0000 "GET /ocs/v2.php" 304
           # 1.1.1.1 -  28/Sep/2023:21:13:10 +0000 "GET /ocs/v2.php" 304
-          [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ - \S* \S+ \+0000 "(DELETE|GET) /ocs/(v1|v2)\.php" (200|304|404)
+          [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ - \S* \S+ \+0000 "(DELETE|GET) /ocs/(v1|v2)\.php" (200|204|304|404)
           [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ - \S* \S+ \+0000 "GET /ocs-provider/index\.php" 200
           [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ - \S* \S+ \+0000 "PROPFIND /public\.php" (207|401|404)
         '';