[apparmor] wrong loggingtime in apparmorlog

Hajo Locke Hajo.Locke at gmx.de
Fri Jan 30 08:52:54 UTC 2015


Hello,

system is Ubuntu14.04 and apparmor 2.8.95~2430-0ubuntu5.1

Sometimes i see wrong time in my apparmor-logs.
example: current date is "Fr 30. Jan 09:23:01 CET 2015"

The apparmor-log logs these line in same moment:

Jan 30 10:49:20 myhostname kernel: type=1400 
audit(1422606208.759:6742033): apparmor="DENIED" operation="open" 
..............
The timestamp 1422606208 in brackets is correct.

Other logs like syslog/maillog written by syslog are ok and look normal.
I think i do not something special in my apparmor-confs, just denying 
some binaries.

audit deny /bin/programname x,

After rebooting problem is gone for unknown time but will return. It 
seems  that difference of realtime and loggingtime increases by uptime 
of server.

Somebody knows what happens here?

Thanks,
Hajo





More information about the AppArmor mailing list