diff -up openssh-5.8p1/audit-linux.c.audit1a openssh-5.8p1/audit-linux.c

--- openssh-5.8p1/audit-linux.c.audit1a	2011-02-24 13:16:51.000000000 +0100

+++ openssh-5.8p1/audit-linux.c	2011-02-24 13:17:17.000000000 +0100

@@ -143,7 +143,7 @@ audit_connection_from(const char *host, 

 void

 audit_run_command(const char *command)

 {

-	if (!user_login_count++) 

+	if (!user_login_count++ && !options.use_pam) 

 		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

 		    NULL, "ssh", 1, AUDIT_USER_LOGIN);

 	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

@@ -155,7 +155,7 @@ audit_end_command(const char *command)

 {

 	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

 	    NULL, "ssh", 1, AUDIT_USER_END);

-	if (!--user_login_count) 

+	if (!--user_login_count && !options.use_pam) 

 		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

 		    NULL, "ssh", 1, AUDIT_USER_LOGOUT);

 }

@@ -163,7 +163,7 @@ audit_end_command(const char *command)

 void

 audit_session_open(struct logininfo *li)

 {

-	if (!user_login_count++) 

+	if (!user_login_count++ && !options.use_pam) 

 		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

 		    NULL, li->line, 1, AUDIT_USER_LOGIN);

 	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

@@ -175,7 +175,7 @@ audit_session_close(struct logininfo *li

 {

 	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

 	    NULL, li->line, 1, AUDIT_USER_END);

-	if (!--user_login_count) 

+	if (!--user_login_count && !options.use_pam) 

 		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

 		    NULL, li->line, 1, AUDIT_USER_LOGOUT);

 }