search for: tooar

...e the rules ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: \(pam_[[:alnum:]]+\) session opened for user [[:alnum:]-]+ by \(uid=[0-9]+\)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ CRON\[[0-9]+\]: \(pam_[[:alnum:]]+\) session closed for user [[:alnum:]-]+$ to ignore lines like 10:17:01 at 04-03-2007 tooar CRON[6356]: (pam_unix) session opened for user root by (uid=0) 10:17:01 at 04-03-2007 tooar CRON[6356]: (pam_unix) session closed for user root but I still get emails from logcheck with those lines. I've tried to test the rules by doing egrep -v -f ignore.d.paranoid/cron /var/log/messages |...