Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Running Ubuntu Linux 9.04, and I see these odd log lines in dmesg:

[ 18.673752] type=1505 audit(1240159967.221:2): operation="profile_load" name="/usr/share/gdm/guest-session/Xsession" name2="default" pid=2197
[ 18.730952] type=1505 audit(1240159967.278:3): operation="profile_load" name="/sbin/dhclient-script" name2="default" pid=2201
[ 18.731093] type=1505 audit(1240159967.278:4): operation="profile_load" name="/sbin/dhclient3" name2="default" pid=2201
[ 18.731141] type=1505 audit(1240159967.278:5): operation="profile_load" name="/usr/lib/NetworkManager/nm-dhcp-client.action" name2="default" pid=2201
[ 18.731182] type=1505 audit(1240159967.278:6): operation="profile_load" name="/usr/lib/connman/scripts/dhclient-script" name2="default" pid=2201
[ 18.871720] type=1505 audit(1240159967.417:7): operation="profile_load" name="/usr/lib/cups/backend/cups-pdf" name2="default" pid=2206
[ 18.871913] type=1505 audit(1240159967.417:8): operation="profile_load" name="/usr/sbin/cupsd" name2="default" pid=2206
[ 18.909533] type=1505 audit(1240159967.458:9): operation="profile_load" name="/usr/sbin/tcpdump" name2="default" pid=2210

What generates them, and should I be worried?

share|improve this question
up vote 5 down vote accepted

It's AppArmor loading it's profiles as applications start up.

For those that don't know AppArmor is similar to SE Linux in that it monitors and restricts based on a set of profiles usually configured in /etc/apparmor.d

The log entries you are seeing are good log entries and are showing that AppArmor is loading up and doing it's thing. Generally you can ignore them but it's always a good idea to remember AppArmor exists as it can bite you.

e.g. I reconfigured MySQL on a Ubuntu system to use /home/mysql for it's data files and it wouldn't start because AppArmor was blocking access to it. The MySQL logs just said "Permission Denied" where as syslog told me that AppArmor was stopping it.

share|improve this answer
any way to make it not spam dmesg ? it is impossible to work on tty console while it spamms "ALLOWED" – zb' Feb 16 '14 at 23:36

No, that's just the kernel's audit subsystem getting a little overly frisky.

share|improve this answer

As womble said, it's OK.

If you're running logcheck, add a regex to filter out these lines

share|improve this answer

There has long been a desire for reasonable auditing of significant activity on Unix systems.

Auditd is Linux's best example of failure at producing a useful implementation of this. It seems nice at first, yet it is completely useless, with signal-to-noise ratio of zero.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.