diff --color -ruNp a/audit-linux.c b/audit-linux.c
--- a/audit-linux.c	2024-05-09 12:38:08.843017319 +0200
+++ b/audit-linux.c	2024-05-09 12:47:05.162267634 +0200
@@ -52,7 +52,7 @@ extern u_int utmp_len;
 const char *audit_username(void);
 
 static void
-linux_audit_user_logxxx(int uid, const char *username,
+linux_audit_user_logxxx(int uid, const char *username, const char *hostname,
     const char *ip, const char *ttyn, int success, int event)
 {
 	int audit_fd, rc, saved_errno;
@@ -66,7 +66,7 @@ linux_audit_user_logxxx(int uid, const c
 	}
 	rc = audit_log_acct_message(audit_fd, event,
 	    NULL, "login", username ? username : "(unknown)",
-	    username == NULL ? uid : -1, NULL, ip, ttyn, success);
+	    username == NULL ? uid : -1, hostname, ip, ttyn, success);
 	saved_errno = errno;
 	close(audit_fd);
 
@@ -181,9 +181,11 @@ audit_run_command(struct ssh *ssh, const
 {
 	if (!user_login_count++)
 		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+		    options.use_dns ? remote_hostname(ssh) : NULL,
 		    ssh_remote_ipaddr(ssh),
 		    "ssh", 1, AUDIT_USER_LOGIN);
 	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+	    options.use_dns ? remote_hostname(ssh) : NULL,
 	    ssh_remote_ipaddr(ssh),
 	    "ssh", 1, AUDIT_USER_START);
 	return 0;
@@ -193,10 +195,12 @@ void
 audit_end_command(struct ssh *ssh, int handle, const char *command)
 {
 	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+	    options.use_dns ? remote_hostname(ssh) : NULL,
 	    ssh_remote_ipaddr(ssh),
 	    "ssh", 1, AUDIT_USER_END);
 	if (user_login_count && !--user_login_count)
 		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+		    options.use_dns ? remote_hostname(ssh) : NULL,
 		    ssh_remote_ipaddr(ssh),
 		    "ssh", 1, AUDIT_USER_LOGOUT);
 }
@@ -211,19 +215,27 @@ void
 audit_session_open(struct logininfo *li)
 {
 	if (!user_login_count++)
-		linux_audit_user_logxxx(li->uid, NULL, li->hostname,
+		linux_audit_user_logxxx(li->uid, NULL,
+		    options.use_dns ? li->hostname : NULL,
+		    options.use_dns ? NULL : li->hostname,
 		    li->line, 1, AUDIT_USER_LOGIN);
-	linux_audit_user_logxxx(li->uid, NULL, li->hostname,
+	linux_audit_user_logxxx(li->uid, NULL,
+	    options.use_dns ? li->hostname : NULL,
+	    options.use_dns ? NULL : li->hostname,
 	    li->line, 1, AUDIT_USER_START);
 }
 
 void
 audit_session_close(struct logininfo *li)
 {
-	linux_audit_user_logxxx(li->uid, NULL, li->hostname,
+	linux_audit_user_logxxx(li->uid, NULL,
+	    options.use_dns ? li->hostname : NULL,
+	    options.use_dns ? NULL : li->hostname,
 	    li->line, 1, AUDIT_USER_END);
 	if (user_login_count && !--user_login_count)
-		linux_audit_user_logxxx(li->uid, NULL, li->hostname,
+		linux_audit_user_logxxx(li->uid, NULL,
+		    options.use_dns ? li->hostname : NULL,
+		    options.use_dns ? NULL : li->hostname,
 		    li->line, 1, AUDIT_USER_LOGOUT);
 }
 
@@ -236,6 +248,7 @@ audit_event(struct ssh *ssh, ssh_audit_e
 		linux_audit_user_auth(-1, audit_username(),
 			ssh_remote_ipaddr(ssh), "ssh", 0, event);
 		linux_audit_user_logxxx(-1, audit_username(),
+			options.use_dns ? remote_hostname(ssh) : NULL,
 			ssh_remote_ipaddr(ssh), "ssh", 0, AUDIT_USER_LOGIN);
 		break;
 	case SSH_AUTH_FAIL_PASSWD:
@@ -254,9 +267,11 @@ audit_event(struct ssh *ssh, ssh_audit_e
 		if (user_login_count) {
 			while (user_login_count--)
 				linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+				    options.use_dns ? remote_hostname(ssh) : NULL,
 				    ssh_remote_ipaddr(ssh),
 				    "ssh", 1, AUDIT_USER_END);
 			linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+			    options.use_dns ? remote_hostname(ssh) : NULL,
 			    ssh_remote_ipaddr(ssh),
 			    "ssh", 1, AUDIT_USER_LOGOUT);
 		}
@@ -265,6 +280,7 @@ audit_event(struct ssh *ssh, ssh_audit_e
 	case SSH_CONNECTION_ABANDON:
 	case SSH_INVALID_USER:
 		linux_audit_user_logxxx(-1, audit_username(),
+			options.use_dns ? remote_hostname(ssh) : NULL,
 			ssh_remote_ipaddr(ssh), "ssh", 0, AUDIT_USER_LOGIN);
 		break;
 	default: