aa-log -s yields "read .: is a directory" about apparmor.d HOT 2 CLOSED

Ok I noticed a difference in behavior if I enable/start auditd.service.

Without auditd running:

• (sudo) aa-log: Empty output
• (sudo) aa-log -s: read .: is a directory

With auditd running:

• aa-log: Empty output (exit 0)
• sudo aa-log: Output is produced
• aa-log -s: read .: is a directory
• sudo aa-log -s: (After ~30 seconds): json: cannot unmarshal array into Go struct field systemdLog.MESSAGE of type string

from apparmor.d.

aa-log is looking for audit.log (or syslog) logs file. Therefore, on archlinux, auditd need to be installed and started/enabled for aa-log to provide any result. It will only start creating log after it is running too, so initially, the output will be empty (just reboot and you should see some logs). By default you will also need sudo to read the log file.

I am aware of the issue with aa-log -s on some system (curiously it works fine on my test VM, regardless of the distribution). I will update here, once I fix this bug.

from apparmor.d.