While this could work for real-time log analysis tools such as aa-genprof, assuming we're fine with requiring auditd (which is currently considered to be a workaround), this won't work for aa-logprof.
It seems we're leaning towards not going the auditd way and instead implementing support for the systemd Journal ⇒ I'll reject this issue in favor of https://gitlab.com/apparmor/apparmor/-/issues/213, which is about the latter.
While this could work for real-time log analysis tools such as aa-genprof, assuming we're fine with requiring auditd (which is currently considered to be a workaround), this won't work for aa-logprof.
It seems we're leaning towards not going the auditd way and instead implementing support for the systemd Journal ⇒ I'll reject this issue in favor of https:/ /gitlab. com/apparmor/ apparmor/ -/issues/ 213, which is about the latter.