I'm running auditd with a bunch of rules for PCI-DSS, but i have some anomalies.
cat audit.log | grep type | grep AVC
returns a bunch of entries like
type=AVC msg=audit(1567154215.586:353): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap-update-ns.core" pid=22810 comm="apparmor_parser"
but when running
ausearch -m AVC -if audit.log it doesn't return any entries. Is there something i'm missing ( or has been replaced )?
Also there's a rule for sudo
-w /usr/bin/sudo -p x -k priv_esc but whenever i sudo to root, there isn't a corresponding entry in the audit logs.
Is there something wrong with my setup?