Public bug reported:
snapd has recently (2.76) started emitting auditing logs carrying a
newline at the closing curly brace, right after stringifying json. This
works (journald DOES accept abitrary input in the message), but it does
make reading and pipe-processing syslog less pleasant.
repro: install firefox snap and run journalctl -b0 _TRANSPORT=audit -o json |
grep "Security logging"
looks something like this:
{..,"MESSAGE":"TRUSTED_APP pid=1337 uid=0 auid=4294967295 ses=4294967295
subj=unconfined
msg='{\"datetime\":\"2026-07-13T16:13:22.597577628Z\",\"level\":\"INFO\",\"description\":\"Security
logging
enabled\",\"app_id\":\"canonical.snapd.snapd\",\"type\":\"security\",\"category\":\"SYS\",\"event\":\"sys_logging_enabled\"}\n'","_UID":"0","SYSLOG_FACILITY":"4","SYSLOG_IDENTIFIER":"audit","_AUDIT_TYPE_NAME":"TRUSTED_APP","_AUDIT_SESSION":"4294967295","_TRANSPORT":"audit","_AUDIT_TYPE":"1121","_SELINUX_CONTEXT":"unconfined"}
** Affects: snapd (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160691
Title:
snapd outputs newline after json log
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/2160691/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
