^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ (/USR/SBIN/)?CRON\[[0-9]+\]: \([_[:alnum:]-]+\) CMD \(.*\)$
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) STARTUP \(fork ok\)$
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \([^[:space:]]+\) RELOAD \([^[:space:]]+\)$
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) INFO \(pidfile fd = [0-9]+\)$
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) INFO \(Running @reboot jobs\)$
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ (/usr/sbin/)?cron\[[0-9]+\]: \(CRON\) INFO \(Skipping @reboot jobs -- not system startup\)$
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ CRON\[[0-9]+\]: \(pam_[[:alnum:]]+\) session (opened|closed) for user [[:alnum:]-]+( by \(uid=[0-9]+\))?$
# Ref.: https://sources.debian.org/src/pam/1.5.3-7/modules/pam_unix/pam_unix_sess.c/#L100
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_[[:alnum:]]+\(cron:session\): session opened for user [[:alnum:]-]+(\(uid=[[:digit:]]+\))?( by ([[:alnum:]-]+)?\(uid=[0-9]+\))?$
# Ref.: https://sources.debian.org/src/pam/1.5.3-7/modules/pam_unix/pam_unix_sess.c/#L130
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_[[:alnum:]]+\(cron:session\): session closed for user [[:alnum:]-]+(\(uid=[[:digit:]]+\))?( by \(uid=[0-9]+\))?$
