http://bugzilla.opensuse.org/show_bug.cgi?id=1208791 Bug ID: 1208791 Summary: [Build 20230228] yast-apparmor: seems unable to parse audit log Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/3150986/modules/scan _audit_logs_ncurses/steps/25 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers@suse.de Reporter: dimstar@opensuse.org QA Contact: jsrain@suse.com Found By: openQA Blocker: Yes ## Observation The test verifies the log file before going to yast: grep 'DENIED' /var/log/audit/audit.log where we get a line back like: type=AVC msg=audit(1677666475.779:625): apparmor="DENIED" operation="capable" class="cap" profile="nscd" pid=3927 comm="nscd" capability=5 capname="kill" The last passing test returned for the same query: type=AVC msg=audit(1677531073.714:615): apparmor="DENIED" operation="capable" profile="nscd" pid=3947 comm="nscd" capability=5 capname="kill" (class="cap" is new - main change on the snapshot is kernel 6.2) Unfortunately, I don't have a yast log yet - will have to try to reproduce locally (but yast does not really show an error, just 'no more records in logfile to process - so the format change might be very likely to be the reason) openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-yast2_apparmor@64bit fails in [scan_audit_logs_ncurses](https://openqa.opensuse.org/tests/3150986/modules/scan_audit_logs_ncurses/st...) ## Test suite description Maintainer: llzhao@suse.com ## Reproducible Fails since (at least) Build [20230228](https://openqa.opensuse.org/tests/3150840) ## Expected result Last good: [20230227](https://openqa.opensuse.org/tests/3148176) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=DVD&machine=64bit&test=yast2_apparmor&version=Tumbleweed) -- You are receiving this mail because: You are on the CC list for the bug.