The source of this is
apparmor_2.3.1+1403.orig/utils/logprof.conf: logfiles =
/var/log/audit/audit.log /var/log/messages /var/log/syslog
This seems to imply that logprof would be able to read multiple log
files.
--
aa-logprof cant parse multiple logfiles
The above problem doesn't show up in 9.10.
$ lsb_release -a sudo dpkg -l |grep apparmor
LSB Version:
core-2.0-ia32:core-2.0-noarch:core-3.0-ia32:core-3.0-noarch:core-3.1-ia32:core-3.1-noarch:core-3.2-ia32:core-3.2-noarch:core-4.0-ia32:core-4.0-noarch
Distributor ID: Ubuntu
Description:
Public bug reported:
Binary package hint: apparmor
See attached log for system information and test commands.
Short version:
Even though apparmor events exist in /var/log/messages aa-logprof doesn't
generate any policies.
tho...@thosjo-lab:~$ grep chrom /var/log/messages| tail -n2
Sep 18 10
** Attachment added: Logs and system information
http://launchpadlibrarian.net/32006390/apparmor.090918.txt
--
aa-logprof doesn't generate any policies
https://bugs.launchpad.net/bugs/432323
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to
