AA-AUDIT(8)

💖 AA-AUDIT — bestie's guide to putting profiles in their audit era 💖

okay so real quick, this is aa-audit from section 8 of the manuals — that's the sysadmin-ish corner of the AppArmor universe, and yes we're about to make it cute. 🎀 stannn

---

✨ NAME ✨

aa-audit — sets an AppArmor security profile to audit mode. that's it, that's the whole job, and she does it flawlessly 💅

---

🦋 SYNOPSIS 🦋

aa-audit <executable> [<executable> ...] [-d /path/to/profiles]
[--no-reload] [-r]

bestie you just hand her one or more executables and she handles the rest, iykyk ✨

---

🌸 OPTIONS 🌸

• -d, --dir /path/to/profiles — tells aa-audit where to go looking for the AppArmor security profile set. if you don't say anything she just assumes /etc/apparmor.d like the icon she is 👑
• --no-reload — do NOT reload the profile after modifying it. that's it. she'll touch it and leave it exactly as-is, no refresh, no glow-up round two 🙈
• -r, --remove — takes the audit mode back off the profile. we love a reversible decision 💖

---

🧚 DESCRIPTION 🧚

so here's the tea 🍓: aa-audit is used to set one or more profiles to audit mode. and what does audit mode actually mean? it means security policy is enforced — she's not playing around, the rules are the rules — but on top of that, all access, both the successes and the failures, gets logged to the system log. every single one. she's watching, she's taking notes, it's giving surveillance but make it ✨structured✨

ngl that's lowkey the move when you wanna see what a profile would be doing in the wild without loosening anything.

and if at some point you're like "okay bestie, I'm done with the audit era," the --remove option can be used to remove the audit mode for the profile. easy come, easy go, periodt 💅

---

💀 BUGS 💀

if you find any bugs (and 😭 I hope you don't), please report them at <https://gitlab.com/apparmor/apparmor/-/issues>. the maintainers are literally obsessed with hearing from you, fr fr 🫶

---

🌈 SEE ALSO 🌈

• apparmor(7)
• apparmor.d(5)
• aa-enforce(1)
• aa-complain(1)
• aa-disable(1)
• aa_change_hat(2)
• <https://wiki.apparmor.net>

go read the whole friend group, they all ate 🔥

---

reminder bestie: audit mode enforces AND logs everything, successes and failures alike. if you don't want the profile reloaded after the change, that's what --no-reload is for. don't skip it and then act surprised, I'm begging 😭

---

and that's the whole page, no notes, 10/10 — brought to you by AppArmor 6.0.0~alpha1, dated 2026-10-05, closing out the AA-AUDIT(8) manual like the main character she is 💜✨🦋