Sending Messages to File

Add an rsyslog configuration file at /etc/rsyslog.d/apparmor.conf containing the following:

# Log kernel generated apparmor log messages to file
:msg,contains,"apparmor" /var/log/apparmor.log

# Uncomment the following to stop logging anything that matches the last rule.
# Doing this will stop logging kernel generated apparmor log messages to the file
# normally containing kern.* messages (eg, /var/log/kern.log)
& ~

and then restart rsyslog. The configuration will redirect all messages that match apparmor and send them to /var/log/apparmor.log.

Next, create a file at /etc/logrotate.d/apparmor with the following contents:

/var/log/apparmor.log {
    rotate 4
    weekly
    compress
    missingok
}

in order to make sure that /var/log/apparmor.log does not get too large and gets rotated weekly.