diff --git a/sau/services.py b/sau/services.py
index 43f79a4..03babf1 100644
--- a/sau/services.py
+++ b/sau/services.py
@@ -10,7 +10,7 @@ import sau.errors
 import sau.helpers
 import sau.platforms
 
-proc_fd_map_re = re.compile(r'^.*(/[^\(]*) \(deleted\)$')
+proc_fd_map_re = re.compile(r'^.*(/(?:usr|lib|opt|etc|s?bin)[^\(]*) \(deleted\)$')
 
 def _warn(policy, msg):
     log = logging.getLogger(sau.LOGNAME)
@@ -28,7 +28,8 @@ def get_deleted_open_files(proc):
             for line in f:
                 match = re.match(proc_fd_map_re, line)
                 if match:
-                    files.add(match.group(1))
+                    fname = match.group(1)
+                    files.add(fname)
         return files
 
     # on FreeBSD psutils open_files() helpfully returns a null path if a file