Hello,

On some Ubuntu 22 and 24 systems, syslog is being cluttered with messages like this which is completely uninteresting:

Feb 05 16:17:01 myhost.example.com audit[353829]: AVC apparmor="ALLOWED" operation="open" profile="/usr/sbin/sssd" name="/proc/420747/cmdline" pid=353829 comm="sssd_nss" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

I would certainly like to know about DENIED events, but how can I have apparmor/audit stop logging about ALLOWED events?

--
Regards,
Troels Arvin

Reply via email to