if $programname == 'CRON' and re_match($msg, "\\(root\\).*CMD.*") then stop