aulast only displaying reboot pseudo-users

Hello, On my machine with audit 2.3.6 the following call to aulast is only displaying the "reboot" pseudo-users and not the actual logins: ausearch --start this-month --raw | aulast --stdin Passing the "--bad" option to aulast, seems to correctly return the failed login attempt. Also, adding the login name to the aulast command doesn't seems to work at all even with the --bad option. OTOH, the aulastlog command seems to work as expected. An idea? Cheers, Laurent Bigonville