In my /etc/rsyslog.conf, I have the following line to log the auth facility into /var/log/auth.log:auth,authpriv.*           /var/log/auth.logbut the file is flooded with cron logs, such as these:CRON[18620]:  pam_unix(cron:session): session opened for user root by (uid=0)CRON[18620]:  pam_unix(cron:session): session closed for user rootI would like to get rid of the cron logs, and only have real auth events being logged into that file. By that I mean, I want to see which users have logged into the system, or made su -. How can I achieve that?
don't log cron events in auth.log
logs;cron;rsyslog
I believe this is what you are looking for::msg, contains, pam_unix(cron:session) ~auth,authpriv.* /var/log/auth.logthe first line matches cron auth events, and deletes them. The second line then logs as per your rule, minus the previously deleted lines.