diff --git a/playbooks/files/system/base/logs/all b/playbooks/files/system/base/logs/all
index f8d800f..62ecf1e 100644
--- a/playbooks/files/system/base/logs/all
+++ b/playbooks/files/system/base/logs/all
@@ -1,4 +1,4 @@
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ systemd\[[0-9]+\]: (Starting|Stopping) [ +[:alnum:]/\-]+\.(\.\.)?$
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ systemd\[[0-9]+\]: Finished (Cleanup of Temporary Directories|Online ext4 Metadata Check for All Filesystems)\.$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ systemd\[[0-9]+\]: (apt-daily\.service|apt-daily-upgrade\.service|man-db\.service): Consumed ([0-9]{1,2}min )?[0-9]{1,2}\.[0-9]{3}s CPU time\.$
+^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ systemd\[[0-9]+\]: (apt-daily\.service|apt-daily-upgrade\.service|logrotate\.service|man-db\.service): Consumed ([0-9]{1,2}min )?[0-9]{1,2}\.[0-9]{3}s CPU time\.$
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ systemd\[[0-9]+\]: rsyslog\.service: Sent signal SIGHUP to main process [[:digit:]]+ \(rsyslogd\) on client request\.$
diff --git a/playbooks/files/system/base/logs/asgard b/playbooks/files/system/base/logs/asgard
index 3fa8a9b..f87f409 100644
--- a/playbooks/files/system/base/logs/asgard
+++ b/playbooks/files/system/base/logs/asgard
@@ -1,6 +1,6 @@
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ systemd\[[0-9]+\]: Finished (Podman auto-update service|Pod service auto-update service|Prune dangling podman images)\.$
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ systemd\[[0-9]+\]: var-lib-containers-storage-overlay\.mount: Succeeded\.$
-^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ podman\[[0-9]+\]: [-[:digit:]]{10} [.:[:digit:]]{8,18} \+[[:digit:]]{4} [[:alpha:]]{3,4} m=\+[.[:digit:]]{1,11} image pull$
+^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ podman\[[0-9]+\]: [-[:digit:]]{10} [.:[:digit:]]{8,18} \+[[:digit:]]{4} [[:alpha:]]{3,4} m=\+[.[:digit:]]+ image pull$
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ podman\[[0-9]+\]: [-[:digit:]]{10} [.:[:digit:]]{8,18} \+0100 CET m=\+[.[:digit:]]{1,11} image remove [[:alnum:]]+$
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ kernel: \[\s*[0-9]+\.[0-9]+\] audit: type=1326 audit\([.:0-9]+\): auid=[0-9]+ uid=[0-9]+ gid=[0-9]+ ses=[0-9]+ subj=unconfined pid=[0-9]+ comm="(git|git-remote-http|git-receive-pac|gitea)" exe="(/app/gitea/gitea|/usr/bin/git|/usr/bin/git-receive-pack|/usr/libexec/git-core/git|/usr/libexec/git-core/git-remote-http|/usr/libexec/git-core/git-remote-https)" sig=0 arch=c000003e syscall=324 compat=0 ip=[[:alnum:]]+ code=0x50000$
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ kernel: \[\s*[0-9]+\.[0-9]+\] audit: type=1326 audit\([.:0-9]+\): auid=[0-9]+ uid=[0-9]+ gid=[0-9]+ ses=[0-9]+ subj=unconfined pid=[0-9]+ comm="ffmpeg" exe="/usr/bin/ffmpeg" sig=0 arch=c000003e syscall=324 compat=0 ip=[[:alnum:]]+ code=0x50000$