When auditing eDirectory events, I see two login events

When auditing eDirectory events, I see two login events
When doing a login at the server console, such as through toolbox.nlm, I only see one login event
Nsure Audit reports two eDirectory login events instead of one

This is working as designed.  What is happening is the Novell Client for Windows is actually using two connections to a NetWare server.  The first connection is an authenticated connection.  In Monitor, you see this as the connection with an asterisk (*) next to it.  The second connection is an authenticated and licensed connection and does not have the asterisk.  Both connections use the FinishAuthentication NDS verb, but only the second connection changes that temporary authenticated connection to a "Logged In" connection.  The FinishAuthentication NDS verb is what Audit uses to indicate that a user has logged in via eDirectory.