Can anyone explain this line in the log.smbd? Searching the internet for apparmor details gets so many hits I cannot find the information. This occurs when smbd is started.kernel: [908896.070790] type=1400 audit(1442305563.416:371): apparmor=STATUS   operation=profile_replace profile=unconfined name=/usr/sbin/nmbd  pid=16870 comm=apparmor_parser
what is apparmor profile_replace log message
apparmor
It means the AppArmor profile affecting the program /usr/sbin/nmbd has been removed (unconfined) using the apparmor_parser tool.  This means that program will run unrestricted by AppArmor from now on (until it's confined again - perhaps that will happen at boot, depending on how your system is set up).If you're asking why it happens, I don't know.  Something is calling apparmor_parser -R, evidently, but why it would want to, or exactly how it gets called, I don't know.