From d088727bdfd0dacb971faf715271442fce109bf0 Mon Sep 17 00:00:00 2001
From: Steve Beattie <sbeattie@ubuntu.com>
Date: Wed, 12 Jan 2011 13:57:19 -0600
Subject: [PATCH] Support newer auditd formatted messages. Patch from mancha on
 irc.

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
---
 utils/SubDomain.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/utils/SubDomain.pm b/utils/SubDomain.pm
index 26cff1bac..12aded306 100755
--- a/utils/SubDomain.pm
+++ b/utils/SubDomain.pm
@@ -2422,7 +2422,7 @@ my $RE_LOG_v2_0_audit  =
 my $RE_LOG_v2_1_audit  =
     qr/type=(UNKNOWN\[150[1-6]\]|APPARMOR_(AUDIT|ALLOWED|DENIED|HINT|STATUS|ERROR))/;
 my $RE_LOG_v2_6_audit =
-    qr/type=AVC\s+audit\([\d\.\:]+\):\s+apparmor=/;
+    qr/type=AVC\s+(msg=)?audit\([\d\.\:]+\):\s+apparmor=/;
 
 sub prefetch_next_log_entry() {
     # if we already have an existing cache entry, something's broken