Russell Coker <[EMAIL PROTECTED]> wrote: > Try this one: > CRON\[.*\]:( )?\(pam_unix\) session (opened)|(closed) for user (root)|(mail)
> [...] > For having two different words match you need to put each word in > braces, "(opened|closed)" is the same as "opene(d|c)losed". No! "session (opened|closed) for user" matches "session opened for user" and "session closed for user" which is what is needed here. "session (opened)|(closed) for user" matches "session opened" and "closed for user" which does not make much sense in this context. Paul
