16.04 apparmor, aa-logprof and log files

[sles]

First of all I'd like to say that by default

/etc/apparmor/logprof.conf

contains

 logfiles = /var/log/audit/audit.log /var/log/syslog /var/log/messages

from which only syslog exists in 16.04.

And there is kern.log , which seems to be better suited for reading apparmor kernel messages.

Why not change this in distribution?

Thank you!

[Seth Arnold (seth-arnold)]

Hi sles; thanks for the bug report.

On systems with auditd installed, the /var/log/audit/audit.log file is used.

AppArmor's dbus mediation is managed through dbus itself. Its logs would not go into the kern.log file.

It might be about time to remove /var/log/messages; at least I don't have it on my last 12.04 LTS precise system, so it hasn't been used in Ubuntu in a while; but it may still be used on other distributions.

Thanks

[Christian Boltz (cboltz)]

openSUSE still has /var/log/messages - at least if you install one of the "normal" syslog deamons (syslogd, syslog-ng or rsyslog) instead of relying on journald ;-)

OTOH, openSUSE never had /var/log/syslog