[Bug 2090887] Re: apport hookutils.py only captures first word per line for KernLog

[Launchpad Bug Tracker]

This bug was fixed in the package apport - 2.31.0-0ubuntu1

---------------
apport (2.31.0-0ubuntu1) plucky; urgency=medium

  * New upstream release:
    - apport-cli: translate the answers Yes and No (LP: #2084650)
    - hookutils: replace iwconfig call by iw dev link calls (LP: #2090790)
    - test: do not check for exact encoded gzip data in test_write_file
      (LP: #2076269)
    - com.ubuntu.apport.policy: fix order of entries (LP: #2084152)
    - test_signal_crashes: replace the use of ping with a custom binary
      (LP: #2089387)
    - hookutils: attach_mac_events: fix dmesg capture regex (LP: #2090887)
  * Drop patches applied upstream and refresh remaining patches

 -- Benjamin Drung <bdrung at ubuntu.com>  Tue, 10 Dec 2024 15:22:21 +0100

** Changed in: apport (Ubuntu)
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to apport in Ubuntu.
https://bugs.launchpad.net/bugs/2090887

Title:
  apport hookutils.py only captures first word per line for KernLog

Status in Apport:
  Fix Released
Status in apport package in Ubuntu:
  Fix Released

Bug description:
  As can be seen in some bugs collecting KernLog.txt, such as
  https://launchpadlibrarian.net/755520804/KernLog.txt from LP:
  #2085412, or https://launchpadlibrarian.net/748024373/KernLog.txt from
  LP: #2079912, only one word of each line is being shown:

  Security
  AppArmor
  AppArmor
  audit(
  AppArmor
  AppArmor
  AppArmor
  AppArmor
  security
  selinux
  security
  security
  security
  security
  security
  apparmor

  I haven't reproduced this behavior myself locally, so wonder if the
  reporters' kern.log files are odd, but I've seen this in several bug
  reports.  I thought it might be the stringify() routine but running
  the apport hook manually on my own system, it works fine.  Looking
  through the source_apparmor.py file I notice the words are ones
  matching the regular expression:

      sec_re = re.compile('audit\(|apparmor|selinux|security', re.IGNORECASE)
      report['KernLog'] = recent_kernlog(sec_re)

  That can't be a coincidence.  However, I don't see how the code would
  produce this behavior, so no idea how to fix it.

To manage notifications about this bug go to:
https://bugs.launchpad.net/apport/+bug/2090887/+subscriptions