[syslog-ng]anyone know where these are coming from?

[Mike Pepe]

Hi all,

My system is running fedora core 3. My /var/log/messages gets full of these:

Feb 20 00:10:03 quadzilla crond(pam_unix)[29549]: session closed for 
user root

for every cron job that runs. However these aren't cron messages, 
because anything from cron goes into a separate log.

I'm wondering if anyone knows a way to filter these without using a 
match rule, or how it's possible to determine what program is sending 
these messages?

thanks

-Mike