aa-notify, aa-genprof: use audispd instead of parsing logs

[intrigeri]

In the discussion that starts at https://bugs.debian.org/759604#55, linux-audit people suggest that a realtime audit event analysis tool should use audispd instead of parsing logs. They pointed us to two possible ways to implement it.

[intrigeri (intrigeri)]

And we got a bug report about aa-genprof not working on a journald-only setup without /var/log/syslog: https://bugs.debian.org/866340. So presumably all utils that currently parse syslog should learn how to use audispd instead of syslog files.

[intrigeri (intrigeri)]

Related:

* https://lists.ubuntu.com/archives/apparmor/2017-December/011370.html
* https://bugs.launchpad.net/ubuntu/+source/audit/+bug/1117804

[intrigeri (intrigeri)]

See also https://gitlab.com/apparmor/apparmor/-/issues/213, where jj shared more workarounds.

[intrigeri (intrigeri)]

While this could work for real-time log analysis tools such as aa-genprof, assuming we're fine with requiring auditd (which is currently considered to be a workaround), this won't work for aa-logprof.

It seems we're leaning towards not going the auditd way and instead implementing support for the systemd Journal ⇒ I'll reject this issue in favor of https://gitlab.com/apparmor/apparmor/-/issues/213, which is about the latter.