Very frequent AppArmor logs after updating PVE

[Raphael11]

Hello everyone,

I have a problem after updating Proxmox. More precisely, I only noticed it after the update, so I’m fairly certain it was caused by it. I updated from 9.0.0 to 9.1.1, and since then I’ve been getting these messages in the system log every few seconds:

Nov 23 17:06:51 pve1 kernel: audit: type=1400 audit(1763914011.755:37407): apparmor="DENIED" operation="sendmsg" class="file" namespace="root//lxc-102_<-var-lib-lxc>" profile="rsyslogd" name="/run/systemd/journal/dev-log" pid=387332 comm="systemd-journal" requested_mask="r" denied_mask="r" fsuid=100000 ouid=100000
Nov 23 17:06:51 pve1 kernel: audit: type=1400 audit(1763914011.759:37408): apparmor="DENIED" operation="sendmsg" class="file" namespace="root//lxc-102_<-var-lib-lxc>" profile="rsyslogd" name="/run/systemd/journal/dev-log" pid=387332 comm="systemd-journal" requested_mask="r" denied_mask="r" fsuid=100000 ouid=100000
Nov 23 17:06:51 pve1 kernel: audit: type=1400 audit(1763914011.769:37409): apparmor="DENIED" operation="sendmsg" class="file" namespace="root//lxc-102_<-var-lib-lxc>" profile="rsyslogd" name="/run/systemd/journal/dev-log" pid=387332 comm="systemd-journal" requested_mask="r" denied_mask="r" fsuid=100000 ouid=100000
Nov 23 17:06:51 pve1 kernel: audit: type=1400 audit(1763914011.789:37410): apparmor="DENIED" operation="sendmsg" class="file" namespace="root//lxc-102_<-var-lib-lxc>" profile="rsyslogd" name="/run/systemd/journal/dev-log" pid=387332 comm="systemd-journal" requested_mask="r" denied_mask="r" fsuid=100000 ouid=100000
Nov 23 17:06:51 pve1 kernel: audit: type=1400 audit(1763914011.806:37411): apparmor="DENIED" operation="sendmsg" class="file" namespace="root//lxc-102_<-var-lib-lxc>" profile="rsyslogd" name="/run/systemd/journal/dev-log" pid=387332 comm="systemd-journal" requested_mask="r" denied_mask="r" fsuid=100000 ouid=100000
Nov 23 17:06:52 pve1 kernel: audit: type=1400 audit(1763914012.000:37412): apparmor="DENIED" operation="sendmsg" class="file" namespace="root//lxc-102_<-var-lib-lxc>" profile="rsyslogd" name="/run/systemd/journal/dev-log" pid=387332 comm="systemd-journal" requested_mask="r" denied_mask="r" fsuid=100000 ouid=100000
Nov 23 17:06:52 pve1 kernel: audit: type=1400 audit(1763914012.010:37413): apparmor="DENIED" operation="sendmsg" class="file" namespace="root//lxc-102_<-var-lib-lxc>" profile="rsyslogd" name="/run/systemd/journal/dev-log" pid=387332 comm="systemd-journal" requested_mask="r" denied_mask="r" fsuid=100000 ouid=100000

I’ve already checked several threads, but I didn’t really understand the actual solution:

https://forum.proxmox.com/threads/o...le-on-test-no-subscription.173920/post-809360

This post most likely describes my issue, but I don’t know which file I need to modify to allow access.

The container is running CasaOS, meaning Docker is running inside it, and it seems to write logs very frequently.

Thank you in advance for any help.

Kind regards

 

[fiona]

Hi,
the file should be /etc/apparmor.d/usr.sbin.rsyslogd inside the container. If it does not exist, look for other files containing rsyslogd in the same directory.

 

[Raphael11]

Thank you very much for the quick help.
It worked.
Best regards