[Bug 2090887] Re: apport hookutils.py only captures first word per line for KernLog

[Alex Murray]

Thanks Bryce - no worries - but just wondering if you tested the patch?
Since when I was investigating this I noticed the following in the API
documentation for re.findall():

The result depends on the number of capturing groups in the pattern. If
there are no groups, return a list of strings matching the whole
pattern. If there is exactly one group, return a list of strings
matching that group. If multiple groups are present, return a list of
tuples of strings matching the groups. Non-capturing groups do not
affect the form of the result.

So I don't think we should add any capturing groups here.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to apport in Ubuntu.
https://bugs.launchpad.net/bugs/2090887

Title:
  apport hookutils.py only captures first word per line for KernLog

Status in apport package in Ubuntu:
  New

Bug description:
  As can be seen in some bugs collecting KernLog.txt, such as
  https://launchpadlibrarian.net/755520804/KernLog.txt from LP:
  #2085412, or https://launchpadlibrarian.net/748024373/KernLog.txt from
  LP: #2079912, only one word of each line is being shown:

  Security
  AppArmor
  AppArmor
  audit(
  AppArmor
  AppArmor
  AppArmor
  AppArmor
  security
  selinux
  security
  security
  security
  security
  security
  apparmor

  I haven't reproduced this behavior myself locally, so wonder if the
  reporters' kern.log files are odd, but I've seen this in several bug
  reports.  I thought it might be the stringify() routine but running
  the apport hook manually on my own system, it works fine.  Looking
  through the source_apparmor.py file I notice the words are ones
  matching the regular expression:

      sec_re = re.compile('audit\(|apparmor|selinux|security', re.IGNORECASE)
      report['KernLog'] = recent_kernlog(sec_re)

  That can't be a coincidence.  However, I don't see how the code would
  produce this behavior, so no idea how to fix it.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/2090887/+subscriptions