Hi all,<br><br>I&#39;m trying to exclude cron events from audit logging. I can&#39;t see how can I do to only exclude this kind of entries:<br><br><br>----<br>time-&gt;Mon Sep 17 11:00:01 2012<br>type=PATH msg=audit(1347872401.521:5212): item=0 name=&quot;/etc/pam.d/system-auth&quot; inode=33635 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00<br>
type=CWD msg=audit(1347872401.521:5212):  cwd=&quot;/var/spool&quot;<br>type=SYSCALL msg=audit(1347872401.521:5212): arch=c000003e syscall=2 success=yes exit=5 a0=2b5b7b627300 a1=0 a2=1b6 a3=0 items=1 ppid=11640 pid=1965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=&quot;crond&quot; exe=&quot;/usr/sbin/crond&quot; key=(null)<br>
----<br><br>I didn&#39;t see any option to exclude events by &#39;exe&#39; or &#39;comm&#39; field. <br><br>Any hints?<br><br>Thanks in advance, Laura<br><br>