$ cat /var/log/kern.log | grep audit
Sep 3 16:58:35 seb128-laptop kernel: [27785.617799] type=1503 audit(1251989915.913:15197): operation="exec" pid=27595 parent=27594 profile="/usr/bin/evince" requested_mask="::x" denied_mask="::x" fsuid=1000 ouid=0 name="/usr/bin/evince"
$ cat /var/log/kern.log | grep audit
Sep 3 16:58:35 seb128-laptop kernel: [27785.617799] type=1503 audit(125198991 5.913:15197) : operation="exec" pid=27595 parent=27594 profile= "/usr/bin/ evince" requested_ mask=": :x" denied_mask="::x" fsuid=1000 ouid=0 name="/ usr/bin/ evince"