The log isn't displaying correctly in the browser because its type is
set as html, but it is a plain text file.

The log is corrupt but in a very odd way that I have never encountered
before.  I have a few possible ideas:

Your kernel ring buffer is being filled and the messages are wrapping,
overwriting previous messages, this is a known problem with messages
going to the ring buffer and is fixed by using the audit daemon. This
can't be the sole cause of the problem because its not an occasional
message being split but many messages with many repeated characters.

Most of the information seems to be intact but has sever "studdering",
with sporadic other bits of information.  The "studdering" seems to be
caused by the interleaving of the same message several times.  This
would get caused by either having multiple sources writting the same
message to the same destination (unlikely) or possibly an application
bug where a small part of a buffer gets written and then fails, and the
application retries writing the buffer, for this to happen the
application would have to be mishandling the return code.

Your specific log output looks like it has both problems happening, I
have to assume that the problem is occuring somewhere in the audit ->
kern buffer -> dd -> ksyslogd -> syslog chain.  I can pretty confidently
rule out the AppArmor module as it builds up each message in a buffer
and either logs it as a whole or fails the whole message.

If this is a reoccurring problem we can track down where it is happening
by cutting out parts of the auditing chain.  Basically try sending the
dd output straight to disk, if that is corrupt then its either kernel
audit or dd, to rule out dd we would remove dd and have ksyslogd read
the ring buffer directly, etc.

-- 
Corrupted AppArmor audit log messages
https://bugs.launchpad.net/bugs/160238
You received this bug notification because you are a member of Ubuntu
Bugs, which is the bug contact for Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to