There's a chance this is the AppArmor "cross profile" IPC check; when one process performs an IPC operation with a second process, in different profiles, both profiles have to allow the operation.
If my guess is right, these ought to be silenced by changing:
/dev/log wl,
to
/dev/log rwl,
in the /etc/apparmor.d/usr.sbin.rsyslogd file and reloading the policy with apparmor_parser --replace /etc/apparmor.d/usr.sbin.rsyslogd
There's a chance this is the AppArmor "cross profile" IPC check; when one process performs an IPC operation with a second process, in different profiles, both profiles have to allow the operation.
If my guess is right, these ought to be silenced by changing:
/dev/log wl,
to
/dev/log rwl,
in the /etc/apparmor. d/usr.sbin. rsyslogd file and reloading the policy with apparmor_parser --replace /etc/apparmor. d/usr.sbin. rsyslogd
Thanks