^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_krb5: pam_sm_setcred\(cron [[:alnum:]]+\): entry:$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_krb5: pam_sm_setcred\(cron [[:alnum:]]+\): pam_get_data\(\): No module specific data is present$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /usr/bin/crontab\[[0-9]+\]: \(root\) LIST \(nobody\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: \(pam_[[:alnum:]]+\) session closed for user [[:alnum:]-]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_[[:alnum:]]+\(cron:session\): session closed for user [[:alnum:]-]+$
# Apr 15 12:05:17 picard /USR/SBIN/CRON[21797]: (CRON) error (grandchild #21799 failed with exit status 100)
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/SBIN/CRON\[[0-9]+\]: \(CRON\) error \(grandchild #[0-9]+ failed with exit status [0-9]+\)$
