HI
after testing , this behavior resulting from KBL function on unix platform , when kbl is enabled , it create a duplicate session from the ssh session for every user , even if this user is not marked interactive in it's auditing checks , if the kbl is disabled (in the seos.ini) and the kbl process is down , this behavior will disappear.
i am checking with the support not to see if there are possibility to make the kbl working without creating additional session or it is by default .
thanks for your replying
wael