[apparmor] wrong loggingtime in apparmorlog

[Christian Boltz]

Hello,

Am Freitag, 30. Januar 2015 schrieb John Johansen:
> On 01/30/2015 12:52 AM, Hajo Locke wrote:
> > system is Ubuntu14.04 and apparmor 2.8.95~2430-0ubuntu5.1
> > 
> > Sometimes i see wrong time in my apparmor-logs.
> > example: current date is "Fr 30. Jan 09:23:01 CET 2015"
> > 
> > The apparmor-log logs these line in same moment:
> > 
> > Jan 30 10:49:20 myhostname kernel: type=1400
> > audit(1422606208.759:6742033): apparmor="DENIED" operation="open"
> > .............. The timestamp 1422606208 in brackets is correct.
> > 
> > Other logs like syslog/maillog written by syslog are ok and look
> > normal. I think i do not something special in my apparmor-confs,
> > just denying some binaries.
> > 
> > audit deny /bin/programname x,
> > 
> > After rebooting problem is gone for unknown time but will return. It
> > seems  that difference of realtime and loggingtime increases by
> > uptime of server.
> >
> > Somebody knows what happens here?
> 
> Interesting, with the timestamp being correct, I am guessing it is
> something to do with timezones. I'll have to dig into audit to say
> much more. AppArmor uses the audit subsystem to do its logging, and
> it is the audit subsystem that is handling the event time.

# date -d @1422606208.759
Fr 30. Jan 09:23:28 CET 2015

Compared to Jan 30 10:49:20, this means an offset of 1 hour, 25 minutes 
and 52 seconds - I wouldn't call that a typical timezone offset ;-)

That said - I have no idea what else could be wrong :-(  - especially 
because you wrote that your mail.log (which is also written by $syslogd) 
contains the correct time stamp.

Are there some interesting log messages before the time difference 
starts?


Regards,

Christian Boltz
-- 
Abgesehen davon, scheint in der heutigen Zeit jeder davon auszugehen,
dass die Windowsbedienung jedem schon bei der Geburt mitgegeben wurde
und jeder der Linux nutzt  automatisch ein komplizierten Umsteigevor-
gang vor sich hat.                  [Martin Kropfinger in suse-linux]