[Bug 2090887] Re: apport hookutils.py only captures first word per line for KernLog

[Benjamin Drung]

https://github.com/canonical/apport/pull/412 was merged upstream.

** Also affects: apport
   Importance: Undecided
       Status: New

** Changed in: apport (Ubuntu)
       Status: New => In Progress

** Changed in: apport (Ubuntu)
   Importance: Undecided => Medium

** Changed in: apport
   Importance: Undecided => Medium

** Changed in: apport
       Status: New => Fix Committed

** Changed in: apport
    Milestone: None => 2.31.0

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to apport in Ubuntu.
https://bugs.launchpad.net/bugs/2090887

Title:
  apport hookutils.py only captures first word per line for KernLog

Status in Apport:
  Fix Committed
Status in apport package in Ubuntu:
  In Progress

Bug description:
  As can be seen in some bugs collecting KernLog.txt, such as
  https://launchpadlibrarian.net/755520804/KernLog.txt from LP:
  #2085412, or https://launchpadlibrarian.net/748024373/KernLog.txt from
  LP: #2079912, only one word of each line is being shown:

  Security
  AppArmor
  AppArmor
  audit(
  AppArmor
  AppArmor
  AppArmor
  AppArmor
  security
  selinux
  security
  security
  security
  security
  security
  apparmor

  I haven't reproduced this behavior myself locally, so wonder if the
  reporters' kern.log files are odd, but I've seen this in several bug
  reports.  I thought it might be the stringify() routine but running
  the apport hook manually on my own system, it works fine.  Looking
  through the source_apparmor.py file I notice the words are ones
  matching the regular expression:

      sec_re = re.compile('audit\(|apparmor|selinux|security', re.IGNORECASE)
      report['KernLog'] = recent_kernlog(sec_re)

  That can't be a coincidence.  However, I don't see how the code would
  produce this behavior, so no idea how to fix it.

To manage notifications about this bug go to:
https://bugs.launchpad.net/apport/+bug/2090887/+subscriptions