This is one method, but it doesn't handle relative paths used to invoke
/usr/bin/crontab.
--- cron.old 2008-01-29 00:24:36.825108701 -0500
+++ cron 2008-01-29 00:25:24.588256415 -0500
@@ -1,4 +1,4 @@
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ crontab\[[0-9]+\]: \([[:alnum:]-]+\) LIST
\([[:alnum:]-]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ crontab\[[0-9]+\]: \([[:alnum:]-]+\) REPLACE
\([[:alnum:]-]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ crontab\[[0-9]+\]: \([[:alnum:]-]+\)
(BEGIN|END) EDIT \([[:alnum:]-]+\)$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (/usr/bin/)?crontab\[[0-9]+\]:
\([[:alnum:]-]+\) LIST \([[:alnum:]-]+\)$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (/usr/bin/)?crontab\[[0-9]+\]:
\([[:alnum:]-]+\) REPLACE \([[:alnum:]-]+\)$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (/usr/bin/)?crontab\[[0-9]+\]:
\([[:alnum:]-]+\) (BEGIN|END) EDIT \([[:alnum:]-]+\)$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: nss_ldap: reconnect(ing|ed)
to LDAP server(\.\.\.| after [0-9]+ attempt\(s\))$
-Ariel