OK, now comes the GOOD solution.
forget about the last post - that one might be the solution for "old school" syslog users but since I use rsyslog there is a much better way:
Simply replace the old
:msg, contains, "pam_unix(cron:session)" ~
This would write everything into /var/log/auth.log BUT messages that contain "pam_unix(cron:session)". (Please note that the tilde "~" at the end of the line is required)
This is exactly what at least I was searching for. Rsyslog has much more fun functionallity and it is worth to have a closer look into it.