Novell LINUX ENTERPRISE SERVER 11 - SECURITY Manual page 321

aa-logprof -d /path/to/profile/directory/
Specifies the full path to the location of the profiles if the profiles are not located
in the standard directory, /etc/apparmor.d/.
aa-logprof -f /path/to/logfile/
Specifies the full path to the location of the log file if the log file is not located in
the default directory, /var/log/audit/audit.log or /var/log/
messages (if auditd is not running).
aa-logprof -m "string marker in logfile"
Marks the starting point for aa-logprof to look in the system log. aa-logprof ignores
all events in the system log before the specified mark. If the mark contains spaces,
it must be surrounded by quotes to work correctly. For example:
aa-logprof -m"17:04:21"
or
logprof -m e2ff78636296f16d0b5301209a04430d
aa-logprof scans the log, asking you how to handle each logged event. Each question
presents a numbered list of AppArmor rules that can be added by pressing the number
of the item on the list.
By default, aa-logprof looks for profiles in /etc/apparmor.d/ and scans the log
in /var/log/messages. In many cases, running aa-logprof as root is enough
to create the profile.
However, there might be times when you need to search archived log files, such as if
the program exercise period exceeds the log rotation window (when the log file is
archived and a new log file is started). If this is the case, you can enter zcat -f `ls
-1tr /var/log/messages*` | aa-logprof -f -.
aa-logprof Example 1
The following is an example of how aa-logprof addresses httpd2-prefork accessing the
file /etc/group. [] indicates the default option.
In this example, the access to /etc/group is part of httpd2-prefork accessing name
services. The appropriate response is 1, which includes a predefined set of AppArmor
rules. Selecting 1 to #include the name service package resolves all of the future
Building Profiles from the Command Line 307