[syslog-ng]anyone know where these are coming from?

Hi all, My system is running fedora core 3. My /var/log/messages gets full of these: Feb 20 00:10:03 quadzilla crond(pam_unix)[29549]: session closed for user root for every cron job that runs. However these aren't cron messages, because anything from cron goes into a separate log. I'm wondering if anyone knows a way to filter these without using a match rule, or how it's possible to determine what program is sending these messages? thanks -Mike