Show recent AppArmor denials
Build a paste-ready command, then review its compatibility and effects before running it.
journalctl -k --since -1h | rg 'apparmor="DENIED"' | tail -20read-onlyno known side effects Compatibility
LinuxVerified for Linux using posix, bash, zsh syntax.
Operational knowledgereview due 2027-01-20
Requirementsjournalctljournalctl must be installed and available on PATH.
Version supportjournalctl Current supported releasesVerified for linux using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalsJul 24 12:03:11 host kernel: audit: type=1400 apparmor="DENIED" operation="open" profile="/usr/sbin/nginx" name="/srv/app/config.json" pid=842 comm="nginx" requested_mask="r" denieRepresentative successful output; values vary with the selected target and system state.
Known errorsjournalctl: command not foundjournalctl is missing or is not available on PATH.
Verifyjournalctl -k --since -1h | rg 'apparmor="DENIED"' | tail -20The output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01journalctlCommandRuns the journalctl stage of this one-liner.
02-kOptionConfigures journalctl with the -k option.
03--sinceOptionLimits results to entries after the supplied time.
04-1hOptionConfigures journalctl with the -1h option.
05|PipelinePasses the output on the left to the command on the right.
06rgCommandRuns the rg stage of this one-liner.
07'apparmor="DENIED"'ArgumentPasses 'apparmor="DENIED"' to rg.
08|PipelinePasses the output on the left to the command on the right.
09tailCommandRuns the tail stage of this one-liner.
10-20OptionConfigures tail with the -20 option.
Example input
journalctl -k --since -1h | rg 'apparmor="DENIED"' | tail -20
Example output
Jul 24 12:03:11 host kernel: audit: type=1400 apparmor="DENIED" operation="open" profile="/usr/sbin/nginx" name="/srv/app/config.json" pid=842 comm="nginx" requested_mask="r" denied_mask="r"
Illustrative output — exact values vary by system and data.
Official sources