AppArmor apache2 OSSEC spam

[micahflee]

Every day, SecureDrop servers reboot and apache2 restarts, and it triggers these two syslog errors, which trigger two Alert level 7 OSSEC emails. I'm not sure why there are two of them, but the emails get sent about 1 minute, then 3 minutes, after the app server OSSEC. They look like this:

OSSEC HIDS Notification.
2017 Nov 04 04:45:38

Received From: (app) 10.20.2.2->/var/log/syslog
Rule: 100012 fired (level 7) -> "Apparmor denied event"
Portion of the log(s):

Nov  4 04:45:37 app kernel: [   98.764680] audit: type=1400 audit(1509785137.281:16): apparmor="DENIED" operation="open" profile="/usr/sbin/apache2" name="/proc/1243/status" pid=1265 comm="apache2" requested_mask="r" denied_mask="r" fsuid=33 ouid=0



 --END OF NOTIFICATION

And this:

OSSEC HIDS Notification.
2017 Nov 04 04:47:30

Received From: (app) 10.20.2.2->/var/log/syslog
Rule: 100012 fired (level 7) -> "Apparmor denied event"
Portion of the log(s):

Nov  4 04:47:29 app kernel: [  210.518560] audit: type=1400 audit(1509785248.997:17): apparmor="DENIED" operation="open" profile="/usr/sbin/apache2" name="/proc/1242/status" pid=1398 comm="apache2" requested_mask="r" denied_mask="r" fsuid=33 ouid=0



 --END OF NOTIFICATION