--- a/pvl/syslog/filter.py	Sun Feb 10 13:31:06 2013 +0200
+++ b/pvl/syslog/filter.py	Sun Feb 10 16:52:51 2013 +0200
@@ -44,7 +44,10 @@
         if prog :
             # normalize
             prog = prog.strip().lower()
-            _, prog = os.path.split(prog)
+    
+            if prog.startswith('/') :
+                # leaves postfix/* intact, but fixes /usr/bin/cron
+                _, prog = os.path.split(prog)
 
         # match
         return self.match_glob(attr, glob, prog)