Description of problem:
Lots of unmatched entries in Kernel Audit logwatch reports in F22

Version-Release number of selected component (if applicable):
F22 & logwatch-7.4.1-2.20140924svn242.fc22.noarch

How reproducible:
100%

Steps to Reproduce:
1. Install F22 and enable logwatch
2. Get daily logwatch reports with huge Kernel Audit sections that start with "**Unmatched Entries** (Only first 100 out of 1290 are printed)"

Additional info:
This patch seems to help:

--- /usr/share/logwatch/scripts/services/audit.orig     2015-06-16 20:32:28.654461680 -0700
+++ /usr/share/logwatch/scripts/services/audit  2015-06-16 20:46:56.216340470 -0700
@@ -126,6 +126,7 @@
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=1 uid=0 auid=[0-9]* ses=[0-9]* subj=system_u:system_r:init_t:s0 .* res=success/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 auid=[0-9]* ses=[0-9]*$/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 auid=[0-9]* ses=[0-9]* subj=.*res=success/) or
+        ( $ThisLine =~ /<audit-\d+> pid=\d+ uid=\d+ auid=\d+ ses=\d+ subj=.*res=success/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 old auid=[0-9]* new auid=[0-9]+ old ses=[0-9]* new ses=[0-9]+ res=1$/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\):  cwd=".*"/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): user/) or