Thousands of pam_unix log entries in logwatch

Question

My logwatch reports, within the CRON section, contain thousands of entries like those below. How can I either reduce the number of log entries OR have logwatch ignore them?

Jan 30 18:49:01 ota3 CRON[14054]: pam_unix(cron:session): session opened for user zzz by (uid=0)

Jan 30 18:49:03 ota3 CRON[13055]: pam_unix(cron:session): session closed for user root

Jan 30 18:49:08 ota3 CRON[14054]: pam_unix(cron:session): session closed for user zzz

Jan 30 18:50:01 ota3 CRON[14108]: pam_unix(cron:session): session opened for user zzzr by (uid=0) 

Answer 1

Go to the /etc/pam.d directory. Open the file common-session-noninteractive in an editor. Look for the following line:

session required pam_unix.so

Above this line, add the following:

session [success=1 default=ignore] pam_succeed_if.so service in cron quiet use_uid

Save the file and exit. Restart crond using something like service cron restart or /etc/init.d/cron restart.

Source: http://languor.us/cron-pam-unix-cron-session-session-opened-closed-user-root-uid0