aulast only displaying reboot pseudo-users

[Laurent Bigonville]

Hello,

On my machine with audit 2.3.6 the following call to aulast is only
displaying the "reboot" pseudo-users and not the actual logins:

ausearch --start this-month --raw | aulast --stdin

Passing the "--bad" option to aulast, seems to correctly return the
failed login attempt.

Also, adding the login name to the aulast command doesn't seems to work
at all even with the --bad option.

OTOH, the aulastlog command seems to work as expected.

An idea?

Cheers,

Laurent Bigonville