apparmor is shutting down syslog - and why ?

[dschinn1001]

here is Ubuntu 12.10 resp. pear OS 7.0.1 with rsyslogd 5.8.6 and kernel 3.10-RC4 :

( since update to kernel 3.10-RC4 - date and time are not shown in syslog any more while scrolling - only now stopped by apparmor - then date and time are shown ? )

obviously apparmor is shutting down rsyslogd - and then syslog stops to protocol and stops to scroll on.

here is output of syslog yesterday, when rsyslogd resp. syslog crashed ( as so often ) :

pluto cracklib: no dictionary update necessary.
Aug 19 11:17:23 pluto kernel: [ 8090.193574] audit_printk_skb: 57 callbacks suppressed
Aug 19 11:17:23 pluto kernel: [ 8090.193576] type=1400 audit(1376903843.989:36): apparmor="STATUS" operation="profile_replace" name="/usr/lib/cups/backend/cups-pdf" pid=26536 comm="apparmor_parser"
Aug 19 11:17:24 pluto kernel: [ 8090.193899] type=1400 audit(1376903843.993:37): apparmor="STATUS" operation="profile_replace" name="/usr/sbin/cupsd" pid=26536 comm="apparmor_parser"
Aug 19 11:17:24 pluto kernel: [ 8090.882368] FW REJECT (input): IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:23:5e:6f:ab:d9:08:00 SRC=10.158.0.1 DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=255 ID=43484 PROTO=UDP SPT=67 DPT=68 LEN=308
Aug 19 11:17:26 pluto kernel: [ 8093.100463] FW REJECT (input): IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:23:5e:6f:ab:d9:08:00 SRC=10.158.0.1 DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=255 ID=43579 PROTO=UDP SPT=67 DPT=68 LEN=308
Aug 19 11:17:28 pluto dhclient: DHCPREQUEST of 78.94.198.169 on eth0 to 10.158.0.1 port 67

( often syslog is simply stopped too by signal 15 - but not here yesterday ... )

[Ken Sharp (kennybobs)]

Why do you think Apparmor is killing rsyslogd? The log you posted doesn't suggest that.

[Launchpad Janitor (janitor)]

[Expired for rsyslog (Ubuntu) because there has been no activity for 60 days.]