[syslog-ng]filtering with regexp

[mar tin]

Hello :)
When cron runs, it sends the following lines
Apr 18 16:50:01 martinII PAM_unix[26181]: (cron)
session opened for user smmsp by (uid=0)
Apr 18 16:50:01 martinII PAM_unix[26182]: (cron)
session opened for user runa by (uid=0)
Apr 18 16:50:01 martinII PAM_unix[26183]: (cron)
session opened for user runa by (uid=0)
Apr 18 16:50:02 martinII PAM_unix[26181]: (cron)
session closed for user smmsp
Apr 18 16:50:25 martinII PAM_unix[26183]: (cron)
session closed for user runa
Apr 18 16:50:27 martinII PAM_unix[26182]: (cron)
session closed for user runa

I want to filter those lines and send them to other
files, so I did:

filter f_cron2{match("(cron) session opened");};
log { source(src); filter(f_cron2);
destination(cron);};

but it sends the lines to auth.log!

what am I doing wrong?




__________________________________________________
Do You Yahoo!?
Yahoo! Tax Center - online filing with TurboTax
http://taxes.yahoo.com/