Resolved AppArmor and Dovecot Logfile kern.log

[Janko1000]

Hello,
we have some Problems with one of our Servers.
The kern.log "explodes" and every Day it increased up to 5GB.

Expand/Collapse Block: kern.log

an 25 02:06:21 phi74302 kernel: [587992.537229] audit: type=1400 audit(1485306381.160:1655319): apparmor="ALLOWED" operation="file_receive" profile="/usr/lib/dovecot/pop3" pid=10631 comm="pop3" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none peer="/usr/lib/dovecot/pop3-login"
Jan 25 02:06:21 phi74302 kernel: [587992.537238] audit: type=1400 audit(1485306381.160:1655320): apparmor="ALLOWED" operation="file_receive" profile="/usr/lib/dovecot/pop3-login" pid=10631 comm="pop3" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none peer="/usr/lib/dovecot/pop3"
Jan 25 02:06:21 phi74302 kernel: [587992.537854] audit: type=1400 audit(1485306381.160:1655321): apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/log" name="run/systemd/journal/dev-log" pid=29423 comm="log" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
Jan 25 02:06:22 phi74302 kernel: [587993.519041] audit: type=1400 audit(1485306382.140:1655322): apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/log" name="run/systemd/journal/dev-log" pid=29423 comm="log" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
Jan 25 02:06:22 phi74302 kernel: [587994.350199] audit: type=1400 audit(1485306382.972:1655323): apparmor="ALLOWED" operation="file_receive" profile="/usr/lib/dovecot/pop3" pid=10633 comm="pop3" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none peer="/usr/lib/dovecot/pop3-login"
Jan 25 02:06:22 phi74302 kernel: [587994.350210] audit: type=1400 audit(1485306382.972:1655324): apparmor="ALLOWED" operation="file_receive" profile="/usr/lib/dovecot/pop3-login" pid=10633 comm="pop3" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none peer="/usr/lib/dovecot/pop3"
Jan 25 02:06:22 phi74302 kernel: [587994.350611] audit: type=1400 audit(1485306382.972:1655325): apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/log" name="run/systemd/journal/dev-log" pid=29423 comm="log" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
Jan 25 02:06:23 phi74302 kernel: [587995.331810] audit: type=1400 audit(1485306383.952:1655326): apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/log" name="run/systemd/journal/dev-log" pid=29423 comm="log" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
Jan 25 02:06:24 phi74302 kernel: [587996.177982] audit: type=1400 audit(1485306384.800:1655327): apparmor="ALLOWED" operation="file_receive" profile="/usr/lib/dovecot/pop3" pid=10635 comm="pop3" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none peer="/usr/lib/dovecot/pop3-login"
Jan 25 02:06:24 phi74302 kernel: [587996.177992] audit: type=1400 audit(1485306384.800:1655328): apparmor="ALLOWED" operation="file_receive" profile="/usr/lib/dovecot/pop3-login" pid=10635 comm="pop3" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none peer="/usr/lib/dovecot/pop3"

 

[IgorG]

Just stop and disable AppArmor:

# /etc/init.d/apparmor stop
# /etc/init.d/apparmor teardown
# update-rc.d -f apparmor remove