Bug 1322771

Description of problem:
Sometimes there's a long delay between a denial event and the setroubleshoot message.

Version-Release number of selected component (if applicable):
setroubleshoot-server-3.3.4-1.fc24.x86_64

How reproducible:
Always a delay, but the actual length varies

Steps to Reproduce:
1. cause an alert
2. wait for setroubleshoot message
3. compare timestamps, e.g. in journal

Actual results:
Time difference between avc denial and "SELinux is preventing" setroubleshoot message was 26 seconds and then 61 seconds.

Expected results:
If there is caching involved, as a user I would expect the first alert of its kind to be forwarded immediately so other components can react. If I run a command that fails, I don't want to wait a minute to see the setroubleshoot evaluation. Following messages can be throttled within reason.

Additional info:
Log of one run: https://fedorapeople.org/groups/cockpit/logs/pull-4118-de47a8b7-verify-fedora-24/TestSelinux-testTroubleshootAlerts-10.111.126.171-FAIL.log

Relevant lines from the logfile:
ar 31 04:29:00 localhost.localdomain audit[1342]: AVC avc:  denied  { read } for  pid=1342 comm="ls" name="admin" dev="dm-0" ino=8727406 scontext=system_u:system_r:httpd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir permissive=0
Mar 31 04:29:26 localhost.localdomain setroubleshoot[1275]: SELinux is preventing ls from read access on the directory admin. For complete SELinux messages. run sealert -l b75cfd72-9a86-4103-a83a-93dbe425e881

Mar 31 04:29:26 localhost.localdomain audit[1369]: AVC avc:  denied  { read } for  pid=1369 comm="sshd" name="ssh_host_ecdsa_key" dev="dm-0" ino=8727397 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file permissive=0
Mar 31 04:30:27 localhost.localdomain setroubleshoot[1275]: SELinux is preventing sshd from read access on the file ssh_host_ecdsa_key. For complete SELinux messages. run sealert -l 41f7e3ab-6b30-4336-b15f-0cf1e5143a69