[apparmor] wrong loggingtime in apparmorlog
Hajo Locke
Hajo.Locke at gmx.de
Fri Jan 30 08:52:54 UTC 2015
Hello,
system is Ubuntu14.04 and apparmor 2.8.95~2430-0ubuntu5.1
Sometimes i see wrong time in my apparmor-logs.
example: current date is "Fr 30. Jan 09:23:01 CET 2015"
The apparmor-log logs these line in same moment:
Jan 30 10:49:20 myhostname kernel: type=1400
audit(1422606208.759:6742033): apparmor="DENIED" operation="open"
..............
The timestamp 1422606208 in brackets is correct.
Other logs like syslog/maillog written by syslog are ok and look normal.
I think i do not something special in my apparmor-confs, just denying
some binaries.
audit deny /bin/programname x,
After rebooting problem is gone for unknown time but will return. It
seems that difference of realtime and loggingtime increases by uptime
of server.
Somebody knows what happens here?
Thanks,
Hajo
More information about the AppArmor
mailing list