rather match the correct service than the parent pid

the last approach only matched if someone was logged in
with ssh. :/