diff --git a/playbooks/files/system/base/logs/yggdrasil b/playbooks/files/system/base/logs/yggdrasil
index da05080..044ee0e 100644
--- a/playbooks/files/system/base/logs/yggdrasil
+++ b/playbooks/files/system/base/logs/yggdrasil
@@ -3,3 +3,4 @@
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ systemd\[[0-9]+\]: mnt-var-lib-yggdrasil-data-pod\\x2d[\\[:alnum:]]+-[\\[:alnum:]]+\.mount: Succeeded\.$
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ sanoid\[[0-9]+\]: INFO: .*$
 ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ sanoid\[[0-9]+\]: taking snapshot .*$
+^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]\-]+ smbd: pam_unix\(samba:session\): session closed for user nobody$