# aa-eventd not working correctly

**URL:** https://forums.suse.com/t/aa-eventd-not-working-correctly/24080
**Category:** SLES Configure-Administer
**Created:** [June 20, 2013, 11:47am UTC](https://forums.suse.com/t/aa-eventd-not-working-correctly/24080 "2013-06-20T11:47:51Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![ptbaranski](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@ptbaranski](https://forums.suse.com/u/ptbaranski)
#### Post date: [June 20, 2013, 11:47am UTC](https://forums.suse.com/t/aa-eventd-not-working-correctly/24080/1 "2013-06-20T11:47:51Z")

</div>

On my two SLES 11 SP2 servers event daemon is not working correctly.

Script “/usr/sbin/aa-eventd” is parsing system log files (audit.log + messages) looking for “$logmsg =~ /APPARMOR/;” but those events appear in fact in low case.

Changing the reg exp comparsion is not solving the problem. Event daemon is creating event.db properly and even sending e-mail notification but only during start up process. After that is stopping processing new events.

rpm -qa | grep armor  
apparmor-parser-2.5.1.r1445-55.59.1  
perl-apparmor-2.5.1.r1445-55.59.1  
apparmor-profiles-2.3-48.18.1  
apparmor-utils-2.5.1.r1445-55.59.1  
yast2-apparmor-2.17.12-0.5.73  
apparmor-docs-2.5.1.r1445-55.59.1  
tomcat\_apparmor-2.5.1.r1445-55.59.1  
apparmor-admin\_en-10.3-8.24.1  
apparmor-profile-editor-0.9.1-268.35  
libapparmor1-2.5.1.r1445-55.59.1