Index: branches/fc15-dev/server/fedora/config/etc/syslog-ng/d_zroot.pl
===================================================================
--- branches/fc15-dev/server/fedora/config/etc/syslog-ng/d_zroot.pl	(revision 1910)
+++ branches/fc15-dev/server/fedora/config/etc/syslog-ng/d_zroot.pl	(revision 1911)
@@ -32,5 +32,5 @@
 sub buildKeyMap($) {
     my ($file) = @_;
-    open (KEYS, $file) or warn "Couldn't open $file: $!";
+    open (KEYS, $file) or (warn "Couldn't open $file: $!\n" and return);
     while (<KEYS>) {
 	chomp;
@@ -58,6 +58,8 @@
 buildKeyMap("/root/.ssh/authorized_keys2");
 
-while (1) {
-    my @message = scalar(<>);
+my @message;
+
+while (my $line = <>) {
+    @message = $line;
     eval {
         local $SIG{ALRM} = sub { die "alarm\n" }; # NB: \n required
@@ -80,6 +82,6 @@
 	} elsif ($message =~ m|Root (\S+) shell|) {
 	    sendmsg($message);
-	} elsif ($message =~ m|session \S+ for user (\S+)|) {
-	    sendmsg($message) if exists $USERS{$1};
+	} elsif ($message =~ m|pam_unix\(([^:]+):session\): session \S+ for user (\S+)|) {
+	    sendmsg($message) if $1 ne "cron" and exists $USERS{$2};
 	} elsif ($message =~ m|^Found matching (\w+) key: (\S+)|) {
 	    if ($sshkeys{$2}) {