How to filter cron messages in syslog-ng

Question

I have a litte problem. I dont know ho to filter cron jobs in syslog-ng. It's spamming my log.

Jun 05 16:09:01  CRON:  pam_unix(cron:session): session opened for user root by (uid=0) 
Jun 05 16:09:01  /USR/SBIN/CRON:  (root) CMD (  [ -x /usr/lib/php5/maxlifetime ] && [ -x /usr/lib/php5/sessionclean ] && [ -d /var/lib/php5 ] && /usr/lib/php5/sessionclean /var/lib/php5 $(/usr/lib/php5/maxlifetime)) 
Jun 05 16:09:01  CRON:  pam_unix(cron:session): session closed for user root 

I tried to use filter but it didn't work.

  filter test { match("[ -x /usr/lib/php5/maxlifetime ]"); };
  log { source(src); filter(test); destination{d_null}; flags(final); };

Answer 1

You're misunderstanding how filters are applied. While this filter and log line does exactly what you're asking them to, they don't affect the other log commands that you have elsewhere in your config.

Instead of directing this filter to /dev/null, you should use it to exclude messages matching the filter in the filter statement for the regular cron log. Since you don't include your full syslog config, I can't be sure that the line below will match perfectly, but here's an example on how to select all cron lines except the ones matching your filter:

filter f_cron { facility(cron) and not filter(test); };