These lines indicate you need to update your AppArmor profile: Jul 4 12:00:30 Office kernel: [ 1782.601471] type=1400 audit(1309806030.808:24): apparmor="DENIED" operation="mknod" parent=1 profile="/usr/sbin/ntpd" name="/var/log/ntp/ntp.log" pid=2520 comm="ntpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0 Jul 4 12:03:34 Office kernel: [ 1965.794660] type=1400 audit(1309806214.006:25): apparmor="DENIED" operation="mknod" parent=1 profile="/usr/sbin/ntpd" name="/var/log/ntp/ntp.log" pid=2592 comm="ntpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Add: /var/log/ntp/ntp.log rw,
To /etc/apparmor.d/usr.sbin.ntpd and then do: $ sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.ntpd
These lines indicate you need to update your AppArmor profile: 0.808:24) : apparmor="DENIED" operation="mknod" parent=1 profile= "/usr/sbin/ ntpd" name="/ var/log/ ntp/ntp. log" pid=2520 comm="ntpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0 4.006:25) : apparmor="DENIED" operation="mknod" parent=1 profile= "/usr/sbin/ ntpd" name="/ var/log/ ntp/ntp. log" pid=2592 comm="ntpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Jul 4 12:00:30 Office kernel: [ 1782.601471] type=1400 audit(130980603
Jul 4 12:03:34 Office kernel: [ 1965.794660] type=1400 audit(130980621
Add: log/ntp/ ntp.log rw,
/var/
To /etc/apparmor. d/usr.sbin. ntpd and then do: d/usr.sbin. ntpd
$ sudo apparmor_parser -r /etc/apparmor.