Hello, Am Freitag, 30. Januar 2015 schrieb John Johansen: > On 01/30/2015 12:52 AM, Hajo Locke wrote: > > system is Ubuntu14.04 and apparmor 2.8.95~2430-0ubuntu5.1 > > > > Sometimes i see wrong time in my apparmor-logs. > > example: current date is "Fr 30. Jan 09:23:01 CET 2015" > > > > The apparmor-log logs these line in same moment: > > > > Jan 30 10:49:20 myhostname kernel: type=1400 > > audit(1422606208.759:6742033): apparmor="DENIED" operation="open" > > .............. The timestamp 1422606208 in brackets is correct. > > > > Other logs like syslog/maillog written by syslog are ok and look > > normal. I think i do not something special in my apparmor-confs, > > just denying some binaries. > > > > audit deny /bin/programname x, > > > > After rebooting problem is gone for unknown time but will return. It > > seems that difference of realtime and loggingtime increases by > > uptime of server. > > > > Somebody knows what happens here? > > Interesting, with the timestamp being correct, I am guessing it is > something to do with timezones. I'll have to dig into audit to say > much more. AppArmor uses the audit subsystem to do its logging, and > it is the audit subsystem that is handling the event time.
# date -d @1422606208.759 Fr 30. Jan 09:23:28 CET 2015 Compared to Jan 30 10:49:20, this means an offset of 1 hour, 25 minutes and 52 seconds - I wouldn't call that a typical timezone offset ;-) That said - I have no idea what else could be wrong :-( - especially because you wrote that your mail.log (which is also written by $syslogd) contains the correct time stamp. Are there some interesting log messages before the time difference starts? Regards, Christian Boltz -- Abgesehen davon, scheint in der heutigen Zeit jeder davon auszugehen, dass die Windowsbedienung jedem schon bei der Geburt mitgegeben wurde und jeder der Linux nutzt automatisch ein komplizierten Umsteigevor- gang vor sich hat. [Martin Kropfinger in suse-linux] -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
