Comment 4 for bug 1425398

There's a chance this is the AppArmor "cross profile" IPC check; when one process performs an IPC operation with a second process, in different profiles, both profiles have to allow the operation.

If my guess is right, these ought to be silenced by changing:

  /dev/log wl,
to
  /dev/log rwl,

in the /etc/apparmor.d/usr.sbin.rsyslogd file and reloading the policy with apparmor_parser --replace /etc/apparmor.d/usr.sbin.rsyslogd

Thanks