/var/log $ for file in dmesg* ; do echo -e "\n\n--- $file --- "; if [ "${file##*.}" == "gz" ] ; then zcat $file | grep 'type=1400' ;else cat $file | grep 'type=1400' ;fi ;done --- dmesg --- [ 6.251986] kernel: audit: type=1400 audit(1611934870.347:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-senddoc" pid=1220 comm="apparmor_parser" [ 6.252398] kernel: audit: type=1400 audit(1611934870.347:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe" pid=1223 comm="apparmor_parser" [ 6.252402] kernel: audit: type=1400 audit(1611934870.347:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe//kmod" pid=1223 comm="apparmor_parser" [ 6.252826] kernel: audit: type=1400 audit(1611934870.347:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/man" pid=1219 comm="apparmor_parser" [ 6.252829] kernel: audit: type=1400 audit(1611934870.347:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_filter" pid=1219 comm="apparmor_parser" [ 6.252831] kernel: audit: type=1400 audit(1611934870.347:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_groff" pid=1219 comm="apparmor_parser" [ 6.252991] kernel: audit: type=1400 audit(1611934870.347:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-oopslash" pid=1226 comm="apparmor_parser" [ 6.254322] kernel: audit: type=1400 audit(1611934870.351:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/cups-browsed" pid=1225 comm="apparmor_parser" [ 6.254777] kernel: audit: type=1400 audit(1611934870.351:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="ippusbxd" pid=1227 comm="apparmor_parser" [ 6.255903] kernel: audit: type=1400 audit(1611934870.351:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/tcpdump" pid=1221 comm="apparmor_parser" --- dmesg.0 --- [ 6.340707] kernel: audit: type=1400 audit(1611693630.431:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-senddoc" pid=1152 comm="apparmor_parser" [ 6.341402] kernel: audit: type=1400 audit(1611693630.431:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe" pid=1155 comm="apparmor_parser" [ 6.341404] kernel: audit: type=1400 audit(1611693630.431:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe//kmod" pid=1155 comm="apparmor_parser" [ 6.341828] kernel: audit: type=1400 audit(1611693630.435:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/man" pid=1151 comm="apparmor_parser" [ 6.341831] kernel: audit: type=1400 audit(1611693630.435:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_filter" pid=1151 comm="apparmor_parser" [ 6.341833] kernel: audit: type=1400 audit(1611693630.435:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_groff" pid=1151 comm="apparmor_parser" [ 6.342673] kernel: audit: type=1400 audit(1611693630.435:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-oopslash" pid=1159 comm="apparmor_parser" [ 6.344075] kernel: audit: type=1400 audit(1611693630.435:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/cups-browsed" pid=1158 comm="apparmor_parser" [ 6.344142] kernel: audit: type=1400 audit(1611693630.435:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="ippusbxd" pid=1180 comm="apparmor_parser" [ 6.346644] kernel: audit: type=1400 audit(1611693630.439:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/tcpdump" pid=1153 comm="apparmor_parser" --- dmesg.1.gz --- [ 6.078889] kernel: audit: type=1400 audit(1611178767.175:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-senddoc" pid=977 comm="apparmor_parser" [ 6.079652] kernel: audit: type=1400 audit(1611178767.175:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe" pid=980 comm="apparmor_parser" [ 6.079654] kernel: audit: type=1400 audit(1611178767.175:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe//kmod" pid=980 comm="apparmor_parser" [ 6.079709] kernel: audit: type=1400 audit(1611178767.175:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-oopslash" pid=983 comm="apparmor_parser" [ 6.079781] kernel: audit: type=1400 audit(1611178767.175:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/man" pid=976 comm="apparmor_parser" [ 6.079783] kernel: audit: type=1400 audit(1611178767.175:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_filter" pid=976 comm="apparmor_parser" [ 6.079785] kernel: audit: type=1400 audit(1611178767.175:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_groff" pid=976 comm="apparmor_parser" [ 6.082034] kernel: audit: type=1400 audit(1611178767.179:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="ippusbxd" pid=988 comm="apparmor_parser" [ 6.082214] kernel: audit: type=1400 audit(1611178767.179:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/cups-browsed" pid=982 comm="apparmor_parser" [ 6.083815] kernel: audit: type=1400 audit(1611178767.179:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/tcpdump" pid=978 comm="apparmor_parser" --- dmesg.2.gz --- [ 5.577594] kernel: audit: type=1400 audit(1611178629.667:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-senddoc" pid=1084 comm="apparmor_parser" [ 5.578519] kernel: audit: type=1400 audit(1611178629.671:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-oopslash" pid=1090 comm="apparmor_parser" [ 5.578676] kernel: audit: type=1400 audit(1611178629.671:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe" pid=1087 comm="apparmor_parser" [ 5.578679] kernel: audit: type=1400 audit(1611178629.671:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe//kmod" pid=1087 comm="apparmor_parser" [ 5.579043] kernel: audit: type=1400 audit(1611178629.671:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/man" pid=1083 comm="apparmor_parser" [ 5.579045] kernel: audit: type=1400 audit(1611178629.671:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_filter" pid=1083 comm="apparmor_parser" [ 5.579047] kernel: audit: type=1400 audit(1611178629.671:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_groff" pid=1083 comm="apparmor_parser" [ 5.580482] kernel: audit: type=1400 audit(1611178629.671:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="ippusbxd" pid=1091 comm="apparmor_parser" [ 5.580548] kernel: audit: type=1400 audit(1611178629.671:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/cups-browsed" pid=1089 comm="apparmor_parser" [ 5.582355] kernel: audit: type=1400 audit(1611178629.675:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/tcpdump" pid=1085 comm="apparmor_parser" --- dmesg.3.gz --- [ 6.188584] kernel: audit: type=1400 audit(1611173889.283:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-senddoc" pid=1095 comm="apparmor_parser" [ 6.188588] kernel: audit: type=1400 audit(1611173889.283:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe" pid=1098 comm="apparmor_parser" [ 6.188590] kernel: audit: type=1400 audit(1611173889.283:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe//kmod" pid=1098 comm="apparmor_parser" [ 6.188687] kernel: audit: type=1400 audit(1611173889.283:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/man" pid=1094 comm="apparmor_parser" [ 6.188690] kernel: audit: type=1400 audit(1611173889.283:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_filter" pid=1094 comm="apparmor_parser" [ 6.188692] kernel: audit: type=1400 audit(1611173889.283:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_groff" pid=1094 comm="apparmor_parser" [ 6.188763] kernel: audit: type=1400 audit(1611173889.283:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-oopslash" pid=1101 comm="apparmor_parser" [ 6.191156] kernel: audit: type=1400 audit(1611173889.287:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="ippusbxd" pid=1102 comm="apparmor_parser" [ 6.191601] kernel: audit: type=1400 audit(1611173889.287:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/tcpdump" pid=1096 comm="apparmor_parser" [ 6.191628] kernel: audit: type=1400 audit(1611173889.287:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/cups-browsed" pid=1100 comm="apparmor_parser" --- dmesg.4.gz --- [ 5.951766] kernel: audit: type=1400 audit(1610727919.043:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-senddoc" pid=1078 comm="apparmor_parser" [ 5.951769] kernel: audit: type=1400 audit(1610727919.043:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-oopslash" pid=1084 comm="apparmor_parser" [ 5.951772] kernel: audit: type=1400 audit(1610727919.043:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe" pid=1081 comm="apparmor_parser" [ 5.951774] kernel: audit: type=1400 audit(1610727919.043:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe//kmod" pid=1081 comm="apparmor_parser" [ 5.951835] kernel: audit: type=1400 audit(1610727919.043:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/man" pid=1077 comm="apparmor_parser" [ 5.951837] kernel: audit: type=1400 audit(1610727919.043:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_filter" pid=1077 comm="apparmor_parser" [ 5.951839] kernel: audit: type=1400 audit(1610727919.043:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_groff" pid=1077 comm="apparmor_parser" [ 5.952902] kernel: audit: type=1400 audit(1610727919.043:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/cups-browsed" pid=1083 comm="apparmor_parser" [ 5.955024] kernel: audit: type=1400 audit(1610727919.047:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/tcpdump" pid=1079 comm="apparmor_parser" [ 5.955651] kernel: audit: type=1400 audit(1610727919.047:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="ippusbxd" pid=1085 comm="apparmor_parser"