diff -up openssh-5.8p1/audit-linux.c.audit1a openssh-5.8p1/audit-linux.c
--- openssh-5.8p1/audit-linux.c.audit1a	2011-02-28 14:45:40.000000000 +0100
+++ openssh-5.8p1/audit-linux.c	2011-02-28 14:46:50.000000000 +0100
@@ -155,7 +155,7 @@ audit_end_command(const char *command)
 {
 	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),
 	    NULL, "ssh", 1, AUDIT_USER_END);
-	if (!--user_login_count) 
+	if (user_login_count && !--user_login_count) 
 		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),
 		    NULL, "ssh", 1, AUDIT_USER_LOGOUT);
 }
@@ -175,7 +175,7 @@ audit_session_close(struct logininfo *li
 {
 	linux_audit_user_logxxx(li->uid, NULL, li->hostname,
 	    NULL, li->line, 1, AUDIT_USER_END);
-	if (!--user_login_count) 
+	if (user_login_count && !--user_login_count) 
 		linux_audit_user_logxxx(li->uid, NULL, li->hostname,
 		    NULL, li->line, 1, AUDIT_USER_LOGOUT);
 }