Ok, the log hadn't been rotated/lost, so I simply filtered out the ntp events from syslog
-- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1733070 Title: ntp apparmor profile problem Status in linux package in Ubuntu: Incomplete Bug description: the apparmor logs shows a couple of problems: Nov 18 13:07:45 carol kernel: [107615.254389] audit: type=1400 audit(1511010465.396:304): apparmor="DENIED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/ntpd" name="run/systemd/journal/dev-log" pid=16818 comm="ntpd" requested_mask="w" denied_mask="w" fsuid=0 ouid=0 and Nov 18 13:07:45 carol kernel: [107615.253441] audit: type=1400 audit(1511010465.395:300): apparmor="DENIED" operation="open" profile="/usr/sbin/ntpd" name="/usr/local/bin/" pid=16815 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 I fixed these by amending /etc/apparmor.d/usr.sbin.ntpd... change the opening to this: /usr/sbin/ntpd flags=(attach_disconnected) { add these: # syslog /run/systemd/journal/dev-log w, # not sure why it needs this /usr/local/bin/ r, To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1733070/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
