HP-UX 11v1 Audit EventID=10240 vs ssh session

[Andrey Kalugin]

I have a trusted system below:
bash-3.1# uname -a
HP-UX spb9460 B.11.11 U 9000/800 3317024911 unlimited-user license

When I use user/group add/mod/del commands from ssh-session or from "xterm" or "dtterm" launched from ssh-session, the Audit system doesn't write EventID=10240.
If these commands are used from XDMCP session or under "rlogin" session - the event 10240 generated ok.

On another system (11v2, Itanium) the event 10240 is generated ok from any kind of session.

SSHD version on both systems is the same.
======
OpenSSH_4.1, OpenSSL 0.9.7e 25 Oct 2004
HP-UX Secure Shell-A.04.00.001, HP-UX Secure Shell version
======

Please help to fix this issue or provide a workaround.



Please he