diff --git a/px/px_loginhistory.py b/px/px_loginhistory.py
index 57c3ff8..e03fa65 100644
--- a/px/px_loginhistory.py
+++ b/px/px_loginhistory.py
@@ -11,24 +11,26 @@ import dateutil.tz
 LAST_USERNAME = "([^ ]+)"
 LAST_DEVICE = "([^ ]+)"
 LAST_ADDRESS = "([^ ]+)?"
+LAST_PID = "( \[[0-9]+\])?"
 LAST_FROM = "(... ... .. ..:..)"
 LAST_DASH = " [- ] "
 LAST_TO = "[^(]*"
 LAST_DURATION = "([0-9+:]+)"
 
 LAST_RE = re.compile(
-  LAST_USERNAME +
-  " +" +
-  LAST_DEVICE +
-  " +" +
-  LAST_ADDRESS +
-  " +" +
-  LAST_FROM +
-  LAST_DASH +
-  LAST_TO +
-  " *(\(" +
-  LAST_DURATION +
-  "\))?"
+    LAST_USERNAME +
+    " +" +
+    LAST_DEVICE +
+    " +" +
+    LAST_ADDRESS +
+    LAST_PID +
+    " +" +
+    LAST_FROM +
+    LAST_DASH +
+    LAST_TO +
+    " *(\(" +
+    LAST_DURATION +
+    "\))?"
 )
 
 TIMEDELTA_RE = re.compile("(([0-9]+)\+)?([0-9][0-9]):([0-9][0-9])")
@@ -89,8 +91,8 @@ def get_users_at(timestamp, last_output=None, now=None):
 
         username = match.group(1)
         address = match.group(3)
-        from_s = match.group(4)
-        duration_s = match.group(6)
+        from_s = match.group(5)
+        duration_s = match.group(7)
 
         if address:
             username += " from " + address

diff --git a/tests/px_loginhistory_test.py b/tests/px_loginhistory_test.py
index 191e602..ffd5019 100644
--- a/tests/px_loginhistory_test.py
+++ b/tests/px_loginhistory_test.py
@@ -289,3 +289,14 @@ def test_to_timedelta(check_output):
     assert px_loginhistory._to_timedelta("01:29") == datetime.timedelta(0, hours=1, minutes=29)
     assert px_loginhistory._to_timedelta("4+01:29") == datetime.timedelta(4, hours=1, minutes=29)
     assert px_loginhistory._to_timedelta("34+01:29") == datetime.timedelta(34, hours=1, minutes=29)
+
+
+def test_realworld_debian(check_output):
+    """
+    Regression test for https://github.com/walles/px/issues/48
+    """
+    now = datetime.datetime(2016, 12, 6, 9, 21, tzinfo=dateutil.tz.tzlocal())
+    testtime = datetime.datetime(2016, 10, 24, 15, 34, tzinfo=dateutil.tz.tzlocal())
+    lastline = "norbert  pts/3        mosh [29846]     Wed Oct 24 15:33 - 15:34  (00:01)"
+
+    assert set(["norbert from mosh"]) == get_users_at(lastline, now, testtime)

Asked to report last line: mosh
Hi,

thanks for the very useful program. I just got the following message when running `px <PID-OF-MY-SESSION>`:
```
Users logged in when cinnamon-session(2417) started:
WARNING: Please report unmatched last line at https://github.com/walles/px/issues/new: <norbert  pts/3        mosh [29846]     Wed Oct 24 15:33 - 15:34  (00:01)>
WARNING: Please report unmatched last line at https://github.com/walles/px/issues/new: <norbert  pts/1        mosh [14332]     Tue Sep 11 15:28 - 15:29  (00:01)>
  norbert from :0
```

This is on Debian/unstable, `px --version` returns `0.0.0`, and the Debian package version is `1.0.13-2`.
tests/px_loginhistory_test.py::test_realworld_debian
tests/px_loginhistory_test.py::test_get_users_at_range tests/px_loginhistory_test.py::test_get_users_at_still_logged_in tests/px_loginhistory_test.py::test_get_users_at_remote tests/px_loginhistory_test.py::test_get_users_at_local_osx tests/px_loginhistory_test.py::test_get_users_at_local_linux tests/px_loginhistory_test.py::test_get_users_at_until_crash tests/px_loginhistory_test.py::test_get_users_at_until_shutdown_osx tests/px_loginhistory_test.py::test_get_users_at_until_shutdown_linux tests/px_loginhistory_test.py::test_get_users_at_multiple tests/px_loginhistory_test.py::test_get_users_at_pseudousers_osx tests/px_loginhistory_test.py::test_get_users_at_pseudousers_linux tests/px_loginhistory_test.py::test_get_users_at_gone_no_logout tests/px_loginhistory_test.py::test_get_users_at_trailing_noise tests/px_loginhistory_test.py::test_get_users_at_unexpected_last_output tests/px_loginhistory_test.py::test_get_users_at_just_run_it tests/px_loginhistory_test.py::test_to_timestamp tests/px_loginhistory_test.py::test_to_timedelta