I don't think this is correct.  This is actually a _manual_ account unlocking.  The automatic unlocking isn't actually an event as such.  An account is simply considered unlocked for a login attempt more than N minutes after it was locked. (IIRC, this is configured as 60 mins).