kernel: [ 6230.503218] audit: type=1400 audit(1534512537.321:398960): apparmor="DENIED" operation="open" profile="snap.gnome-system-monitor.gnome-system-monitor" name="/run/mount/utab" pid=2265 comm="gnome-system-mo" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

[Le Hoang Anh]

This log repeats so many times in file /var/log/syslog and /var/log/kern.log, causing the size of 2 files exceed 100Mb, and the journal folder increase to several Gbs, causing no space left in "Filesystem root".

[John Johansen (jjohansen)]

Sadly yes. AppArmor currently doesn't do audit message deduping, leaving it entirely to the audit infrastructure. Which means denial messages can fill the logs.

There is current work to fix this by providing a dedup cache that will hopefully land in 4.20

[Le Hoang Anh (hoanganhcv)]

Thanks John for your answer.
So do you know what cause this bunch of audit messages, and how could I fix that?

[John Johansen (jjohansen)]

Its being caused by the gnome system-monitor snap. Its author is missing some permissions required to use it properly on your system. It looks like the system monitor is running and it keeps polling the file causing this denial.

The apparmor rule to fix this is

    /run/mount/utab r,

You could add it to the file in
  /var/lib/snapd/apparmor/profiles/snap.gnome-system-monitor (it actually might be under a slightly different variant of - and .)

and manually replace using the apparmor parser

  sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap.gnome-system-monitor

Unfortunately snappy may update this file on you and you will loose the rule you have added.

The best solution is to contact the snap author so he can update the snap to include the new permission in the snaps security manifest.

[Le Hoang Anh (hoanganhcv)]

Thank you so much John, I'm trying your solution.
Based on your answer, it seems like this problem is not because of something special in my computer. Does that mean this problem occurs on every other computers running Ubuntu with gnome (Ubuntu 18.01) ?
(I'm new to Ubuntu, so may have some silly questions :-)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.