Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have hundreds of these log entries:

Feb 13 16:46:56 XXXX kernel: [42982.178922] type=1701 audit(1360799216.852:1514): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=5529 comm="chrome" reason="seccomp" sig=0 syscall=2 compat=0 ip=0x7f3060b476b0 code=0x50000
Feb 13 16:46:56 XXXX kernel: [42982.178943] type=1701 audit(1360799216.852:1515): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=5529 comm="chrome" reason="seccomp" sig=0 syscall=2 compat=0 ip=0x7f3060b476b0 code=0x50000

This behavior is explained here: Why is there "seccomp" events related to Google Chrome in syslog?.

How do I redirect them out of my kern.log file?

I plan to figure out this log later, but I have other projects that would be easier with a smaller kern.log file.

I have seen this: How to enable logging for Google Chrome in Ubuntu 12.04?

The file mentioned is not under my home folder.

Default install. Edit: Basic plug-ins. Single profile. Checked the menu item and the only option %U (no --debug or anything like that)


Google Chrome   24.0.1312.69 (Official Build 180721)
OS  Linux 
WebKit  537.17 (@140072)
JavaScript  V8
User Agent  Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.17 (KHTML, like Gecko)
Chrome/24.0.1312.69 Safari/537.17
share|improve this question
In the accepted answer. ~/.config/google-chrome or ~/.config/chrome has no .log file that I can find. I was assuming this is default behavior and I thought it was a good trouble shooting step. Should I remove the reference? – DarkSheep Feb 14 '13 at 2:31
Okay, I checked syslog as well. No seccomp entry for me. What is your google-chrome version? Maybe you could add to your question information from typing about: in the address bar and hitting enter. I'm deleting my earlier comments before the system tries to push us into chat! – user25656 Feb 14 '13 at 2:49
up vote 0 down vote accepted

You'll need to tweak your rsyslog configuration to process those messages differently. So for example you can create /etc/rsyslog.d/30-seccomp.conf:

if $msg contains 'comm="chrome" reason="seccomp"' then /var/log/chrome.log
& ~

Followed by:

initctl restart syslog

The rule states if the message contains the string then forward it to /var/log/chrome.log. The second line means that anything that matched the first line should be dropped.

If you just want to drop all these messages:

if $msg contains 'comm="chrome" reason="seccomp"' then ~
share|improve this answer

If using an open source version of Chrome (like on Ubuntu the version installed with sudo apt-get install chromium-browser) then redirecting the seccomp logging requires a slightly-different rsyslogd filter.

For reference Chromium syslog messages look like this:

Feb 23 17:33:16 XXX kernel: [507549.071917] type=1701 audit(1393194796.933:3999): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=21016 comm="chromium-browse" reason="seccomp" sig=0 syscall=2 compat=0 ip=0x7f2b40940eb0 code=0x50001

And building on stsquad's answer, here is an /etc/rsyslog.d/30-seccomp.conf that's been generalized to work with both Google Chrome and open source Chromium:

if $msg contains ' reason="seccomp"' and $msg contains ' comm="chrom' \
  then -/var/log/chrome-seccomp.log
& ~
share|improve this answer

How about scripting a grep hack?

grep -Ev 'chrome' /var/log/kern.log >> /var/log/smaller.kern.log
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.