apparmor and ausearch

[novadean]

It appears that when piping apparmor events from /var/log/audit/audit.log into ausearch some events get lost.

I'm using this command:

/usr/bin/cat /var/log/audit/audit.log | /sbin/ausearch -i -if /dev/stdin

It seems to truncate the message however:

For example raw format of the audit.log contains this entry:

type=APPARMOR msg=audit(1236830026.790:1976): PERMITTING attribute (mode,ctime,) change to /root/Desktop/testfile.txt (chmod(16497) profile bin/chmod active /bin/chmod)

Piping through ausearch gives:
type=APPARMOR msg=audit(03/11/09 20:53:46.790:1975)

Any ideas to make ausearch stop truncating the message?