Description of problem:


Version-Release number of selected component (if applicable):


How reproducible:

Every morning I get a log file that says:

--------------------- pam_unix Begin ------------------------ 

 runuser:
    Password Failures:
       beaglidx: 2 Time(s)
    Sessions Opened:
       beaglidx by (uid=0): 2 Time(s)
 
 
---------------------- pam_unix End ------------------------- 

When beaglidx seems to run normally every day (or abnormally as I have it turned
off.)  But logwatch summarizes what is seemingly a normal exit as failure:

/usr/share/logwatch/scripts/services/pam_unix

268    } elsif (($service eq 'runuser') or ($service eq 'runuser-l')){
269       if ($line =~ s/^session opened for user (.+)/$1/) {
270          $data{$service}{'Sessions Opened'}{$line}++;
271       } elsif ($line =~ s/^session closed for user (.+)/$1/) {
272          $data{$service}{'Password Failures'}{$line}++;
273       } else {
274            $data{$service}{'Unknown Entries'}{$line}++;                         
275       }

When I run beaglidx by hand via runuser:

/home/dmobrien: /sbin/runuser -s /bin/bash beaglidx -c 'id -a' 
uid=58(beaglidx) gid=58(beaglidx) groups=58(beaglidx)
context=system_u:system_r:unconfined_t

It runs fine and the output in the /var/log/secure log file says:

/var/log: tail -f secure

Nov 18 07:27:21 yorky sudo: dmobrien : TTY=pts/2 ; PWD=/home/dmobrien ;
USER=root ; COMMAND=/usr/bin/ksh
Nov 18 07:27:46 yorky runuser: pam_unix(runuser:session): session opened for
user beaglidx by dmobrien(uid=0)
Nov 18 07:27:46 yorky runuser: pam_unix(runuser:session): session closed for
user beaglidx

So how is this a "password failure"?

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info: