diff -up openssh-5.8p1/audit-linux.c.audit1a openssh-5.8p1/audit-linux.c

--- openssh-5.8p1/audit-linux.c.audit1a	2011-02-28 14:45:40.000000000 +0100

+++ openssh-5.8p1/audit-linux.c	2011-02-28 14:46:50.000000000 +0100

@@ -155,7 +155,7 @@ audit_end_command(const char *command)

 {

 	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

 	    NULL, "ssh", 1, AUDIT_USER_END);

-	if (!--user_login_count) 

+	if (user_login_count && !--user_login_count) 

 		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

 		    NULL, "ssh", 1, AUDIT_USER_LOGOUT);

 }

@@ -175,7 +175,7 @@ audit_session_close(struct logininfo *li

 {

 	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

 	    NULL, li->line, 1, AUDIT_USER_END);

-	if (!--user_login_count) 

+	if (user_login_count && !--user_login_count) 

 		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

 		    NULL, li->line, 1, AUDIT_USER_LOGOUT);

 }