^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_krb5: pam_sm_setcred\(cron [[:alnum:]]+\): entry:$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_krb5: pam_sm_setcred\(cron [[:alnum:]]+\): pam_get_data\(\): No module specific data is present$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /usr/bin/crontab\[[0-9]+\]: \(root\) LIST \(nobody\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: \(pam_[[:alnum:]]+\) session closed for user [[:alnum:]-]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_[[:alnum:]]+\(cron:session\): session closed for user [[:alnum:]-]+$
# Apr 15 12:05:17 picard /USR/SBIN/CRON[21797]: (CRON) error (grandchild #21799 failed with exit status 100)
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/SBIN/CRON\[[0-9]+\]: \(CRON\) error \(grandchild #[0-9]+ failed with exit status [0-9]+\)$

# For machines managed by chef with a different type of timestamp
^[ -+T:0-9]+ [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_krb5: pam_sm_setcred\(cron [[:alnum:]]+\): entry:$
^[ -+T:0-9]+ [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_krb5: pam_sm_setcred\(cron [[:alnum:]]+\): pam_get_data\(\): No module specific data is present$
^[ -+T:0-9]+ [._[:alnum:]-]+ /usr/bin/crontab\[[0-9]+\]: \(root\) LIST \(nobody\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ CRON\[[0-9]+\]: \(pam_[[:alnum:]]+\) session closed for user [[:alnum:]-]+$
^[ -+T:0-9]+ [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_[[:alnum:]]+\(cron:session\): session closed for user [[:alnum:]-]+$
^[ -+T:0-9]+ [._[:alnum:]-]+ /USR/SBIN/CRON\[[0-9]+\]: \(CRON\) error \(grandchild #[0-9]+ failed with exit status [0-9]+\)$

# From logcheck/ignore.d.paranoid/cron
^[ -+T:0-9]+ [._[:alnum:]-]+ (/USR/SBIN/)?CRON\[[0-9]+\]: \([_[:alnum:]-]+\) CMD \(.*\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) STARTUP \(fork ok\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \([^[:space:]]+\) RELOAD \([^[:space:]]+\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) INFO \(pidfile fd = [0-9]+\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) INFO \(Running @reboot jobs\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) INFO \(Skipping @reboot jobs -- not system startup\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ CRON\[[0-9]+\]: \(pam_[[:alnum:]]+\) session (opened|closed) for user [[:alnum:]-]+( by \(uid=[0-9]+\))?$
^[ -+T:0-9]+ [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_[[:alnum:]]+\(cron:session\): session (opened|closed) for user [[:alnum:]-]+( by \(uid=[0-9]+\))?$


#Common matches from logcheck
# 2017-06-21T08:02:03.168032+01:00 afs26 CRON[23675]: pam_unix(cron:session): session closed for user logcheck
^[ -+T:0-9]+ [._[:alnum:]-]+ (/USR/SBIN/)?CRON\[[0-9]+\]: \([_[:alnum:]-]+\) CMD \(.*\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) STARTUP \(fork ok\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \([^[:space:]]+\) RELOAD \([^[:space:]]+\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) INFO \(pidfile fd = [0-9]+\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) INFO \(Running @reboot jobs\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) INFO \(Skipping @reboot jobs -- not system startup\)$
^[ -+T:0-9]+ [._[:alnum:]-]+ CRON\[[0-9]+\]: \(pam_[[:alnum:]]+\) session (opened|closed) for user [[:alnum:]-]+( by \(uid=[0-9]+\))?$
^[ -+T:0-9]+ [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_[[:alnum:]]+\(cron:session\): session (opened|closed) for user [[:alnum:]-]+( by \(uid=[0-9]+\))?$
