[ossec-list] SSH logs "first time user logged in"

[Forrest Aldrich]

I'm getting a few of these: OSSEC HIDS Notification. 2006 Sep 08 10:35:25 Received From: (firewall) 192.168.1.1->/var/log/auth.log Rule: 10100 fired (level 4) -> "First time user logged in." Portion of the log(s): sshd[97130]: Accepted keyboard-interactive/pam for forrie from xx.xx.xx.xx port 34328 ssh2 And it's definitely NOT the first time I've logged in. Is this a bug?  How does it track when someone logs in for the first time... etc? _F