Comment 3 for bug 1577948

The issue here is that logwatch does match apparmor STATUS messages generally, but not when they have profile="unconfined" between operation and name.

I didn't find authoritative documentation on what this log entry means, but the answer to the following askubuntu post suggests this may be recording the disabling of an apparmor profile - something that may be of concern to sysadmins and thus should be flagged as noteworthy in the logwatch report.

https://askubuntu.com/questions/825274/apparmor-audit-logs-what-does-this-mean