responding to @intrigeri (sorry this got lost some how).
tldr: yes we are basically on the same page.
AppArmor does not fit into the 1400 range formats, every one of our
messages have some custom fields. Some of them could be
reformated/reworked to share more, but we would still need custom
As far as I know, no one has made an effort to try to improve the
situation lately. There's some discussion at
https://lists.ubuntu.com/archives/apparmor/2024-February/013091.html
that may be enlightening, if not encouraging.
Thanks
--
You received this bug notification because you are a member
On 2/9/24 10:53, cati55 wrote:
When apparmor logs events with audit type AVC, the logs cannot be found by
usual audit tools because the entry is malformed as stated in this auditd
bugreport
https://github.com/linux-audit/audit-userspace/issues/351#issuecomment-1932211875
To quite the
When apparmor logs events with audit type AVC, the logs cannot be found by
usual audit tools because the entry is malformed as stated in this auditd
bugreport
https://github.com/linux-audit/audit-userspace/issues/351#issuecomment-1932211875
To quite the maintainer:
> If they are going to emit
