[Logcheck-devel] Bug#249474: logcheck-database: more "session opened" and "session closed" lines getting through

[Dan Christensen]

Package: logcheck-database
Version: 1.2.20a
Severity: normal

logcheck e-mails me the following lines when I log in and out of xdm:

  May 17 12:54:07 jdc    : (pam_unix) session closed for user jdc
  May 17 12:55:23 jdc    : (pam_unix) session opened for user jdc by root(uid=0)

And this line when I log in on the console:

  May 17 12:54:14 jdc login[26025]: (pam_unix) session opened for user root by LOGIN(uid=0)

And this line when I log in via ssh:

  May 16 14:27:55 jdc sshd[26584]: (pam_unix) session opened for user root by root(uid=0)

(Note the word "root" right before "(uid=0)".)

Also, reportbug generated the information at the bottom of this
message, but it isn't all correct.  I have

  REPORTLEVEL="server"

in my logcheck.conf file.

-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.4.26-1-686-smp
Locale: LANG=C, LC_CTYPE=C

Versions of packages logcheck-database depends on:
ii  debconf [debconf-2.0]         1.4.25     Debian configuration management sy

-- debconf information:
* logcheck-database/conffile-cleanup: true
* logcheck-database/rules-directories-note: 
* logcheck-database/security_level: workstation
* logcheck-database/standard-rename-note: