better regex for shutdown behavior