Index: server/fedora/config/etc/syslog-ng/d_zroot.pl
===================================================================
--- server/fedora/config/etc/syslog-ng/d_zroot.pl	(revision 666)
+++ server/fedora/config/etc/syslog-ng/d_zroot.pl	(revision 667)
@@ -45,6 +45,6 @@
 	} elsif ($message =~ m|Root (\S+) shell|) {
 	    sendmsg($message);
-	} elsif ($message =~ m|session \S+ for user root\b|) {
-	    sendmsg($message);
+	} elsif ($message =~ m|session \S+ for user (\S+)|) {
+	    sendmsg($message) if exists $USERS{$1};
 	} elsif ($message =~ m|^Connection closed|) {
 	    # Do nothing