aa-decode

Decode hex-encoded strings in AppArmor logs

TLDR

Decode a hex string

$ aa-decode [hexstring]

Decode a log file

$ sudo aa-decode [logfile]

Decode logs from stdin

$ sudo aa-decode - < [logfile]

Pipe kernel logs through aa-decode

$ cat /var/log/kern.log | aa-decode

aa-decode decodes hexadecimal-encoded strings found in AppArmor log output. It processes audit logs from standard input and converts any hex-encoded AppArmor entries to human-readable format on standard output.
AppArmor encodes certain characters (like spaces and special characters) in hexadecimal format within log entries to prevent parsing issues. This utility converts those back to readable text.