John Johansen b32b898a9a libapparmor: fix log parsing for socklogd ...

The default log format for void linux is not handled by current log
parsing. The following example message results in an invalid record
error.

2021-09-11T20:57:41.91645 kern.notice: [  469.180605] audit: type=1400 audit(1631392703.952:3): apparmor="ALLOWED" operation="mkdir" profile="/usr/bin/kak" name="/run/user/1000/kakoune/" pid=2545 comm="kak" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000

This log message fails on parsing

  kern.notice:

which differs from the expect syslog format of
  host_name kernel:

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/196
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/799
Signed-off-by: John Johansen <john.johansen@canonical.com>

2021-09-13 15:04:06 -07:00

..

libapparmor

libapparmor: fix log parsing for socklogd

2021-09-13 15:04:06 -07:00