Yes, on focal I see the same. Since it's kernel, won't see these in an lxc container, but on bare metal or maybe a vm they add lots of noise.
For Logwatch's purposes, all the apparmor="STATUS" messages should be filtered, as they're just informative. (I suspect many of the apparmor="DENIED" messages relating to snaps and lxc could also be filtered, as they're by definition permission-limited zones, however they're unrelated to this bug.) ** Summary changed: - unmatched entries for apparmor + unmatched entries for apparmor STATUS messages ** Changed in: logwatch (Ubuntu) Importance: Undecided => High ** Changed in: logwatch (Ubuntu) Status: New => Triaged -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1577948 Title: unmatched entries for apparmor STATUS messages To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1577948/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs