Comment 16 for bug 1478087

Verified for openssh as well; it now correctly shows entries in aureport -l too.

Attached is a transcript from the two sessions testing shadow and openssh for audit support.