SUSE Support

Here When You Need Us

audit.log file that has the apparmor (AVC) entries that ausearch can't read.

This document (7015244) is provided subject to the disclaimer at the end of this document.


SUSE Linux Enterprise Server 11 Service Pack 3 (SLES 11 SP3)


On a patched SLES11SP3 server running auditing, ausearch doesn't return any entries in audit.log for apparmor events, that are there.  Here is an example of the entries:

type=AVC msg=audit(1390876383.602:15646): apparmor="DENIED" operation="open" parent=21147 profile="/tmp/ls" name="/var/log/audit/" pid=21598 comm="ls" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
type=AVC msg=audit(1390936201.188:15647): apparmor="ALLOWED" operation="file_lock" parent=7873 profile="/usr/sbin/sshd" name="/tmp/pam_krb5_tmp_FqhNDa" pid=7875 comm="sshd" requested_mask="k" denied_mask="k" fsuid=0 ouid=0

If I do a search a log that has these entries, I get the following results:

# ausearch -m AVC -if audit.log
<no matches>
However if I do a search in the same log for a different event--DAEMON_END--it
finds that:

  # ausearch -m DAEMON_END -if audit.log
  time->Tue Jan 28 12:26:56 2014
  type=DAEMON_END msg=audit(1390937216.800:7163): auditd normal halt, sending
auid=9190 pid=8441 subj= res=success
  time->Tue Jan 28 13:55:03 2014
  type=DAEMON_END msg=audit(1390942503.158:3376): auditd normal halt, sending
auid=9190 pid=10393 subj= res=success


Reported to engineering, solution pending....



This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7015244
  • Creation Date: 19-Jun-2014
  • Modified Date:28-Sep-2022
    • SUSE Linux Enterprise Server

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.