felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

doc: general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-08-30 20:38:30 +01:00
parent fe32720765
commit fb29e8ba74
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
14 changed files with 350 additions and 223 deletions
Download patch file Download diff file Expand all files Collapse all files

40
docs/report.md
View file

@ -11,25 +11,39 @@ When creating [an issue on Github][newissue], please post a link to the [paste]
aa-log -R
```
If this command produce nothing, try:
??? question "No logs with `aa-log`?"
If the log file is empty, check that Auditd is running:
```sh
sudo systemctl status auditd.service
```
If Auditd is disabled aa-log will not have new results, you can enable Auditd with:
```sh
sudo systemctl enable auditd.service --now
```
If this command produces nothing, use `-s` to provide all logs since boot time (provided that `journalctl` collected them):
```sh
aa-log -s -R
```
If the log file is empty, check that Auditd is running:
??? question "No logs with `aa-log -s`?"
On certain distributions/configurations, AppArmor logs in journal could be taken over by *auditd* when it is installed. To overcome this, `systemd-journald-audit.socket` could be enabled:
```sh
sudo systemctl enable systemd-journald-audit.socket
```
You can get older logs with:
```sh
sudo systemctl status auditd.service
aa-log -R -f <nb>
```
If Auditd is disabled aa-log will not have new results, you can enable Auditd by doing the following command:
```sh
sudo systemctl enable auditd.service --now
```
You can get more logs with:
1. `aa-log -R -s` that will provide all apparmor logs since boot time (if journalctl collect them)
2. `aa-log -R -f <nb>` where `<nb>` is `1`, `2`, `3` and `4` (the rotated audit log file)
Where `<nb>` is `1`, `2`, `3` and `4` (the rotated audit log file).
[newissue]: https://github.com/roddhjav/apparmor.d/issues/new
[paste]: https://pastebin.com/