diff --git a/test-cases/apparmor-functional-demo.yaml b/test-cases/apparmor-functional-demo.yaml
index 2ddb94f91038671c56297f8f5fc73fe42ccedfab..9a9ff4aa9d8fc61f8990a63dd953ae4a639cf5bd 100644
--- a/test-cases/apparmor-functional-demo.yaml
+++ b/test-cases/apparmor-functional-demo.yaml
@@ -44,7 +44,7 @@ run:
     - "# Execute the following commands:"
     - echo -n | sudo tee /var/log/audit/audit.log
     - common/run-test-in-systemd --name=run-lava_run_tests --timeout=90 /usr/lib/apparmor-demo/lava_run_tests
-    - sudo cat /var/log/audit/audit.log | aa_log_extract_tokens.pl PERMITTING REJECTING
+    - sudo journalctl -b -t audit -o cat | /usr/bin/aa_log_extract_tokens.sh ALLOWED DENIED
 
 parse:
   fixupdict:
diff --git a/test-cases/apparmor-geoclue.yaml b/test-cases/apparmor-geoclue.yaml
index 460e7920829f20ac4ee1c7362af02d6cf677092b..f6cd29242111087ba175e39ad52a9daada1adde4 100644
--- a/test-cases/apparmor-geoclue.yaml
+++ b/test-cases/apparmor-geoclue.yaml
@@ -44,7 +44,7 @@ run:
     - "# Execute the following commands:"
     - echo -n | sudo tee /var/log/audit/audit.log
     - common/run-test-in-systemd --name run-test-geoclue --timeout 90 /usr/lib/apertis-tests/apparmor/geoclue/test-geoclue
-    - sudo cat /var/log/audit/audit.log | aa_log_extract_tokens.pl PERMITTING REJECTING
+    - sudo journalctl -b -t audit -o cat | /usr/bin/aa_log_extract_tokens.sh ALLOWED DENIED
 
 parse:
   pattern: ^(?P<test_case_id>[\w\-\.]+):\s(?P<result>PASS|pass|FAIL|fail|SKIP|skip|UNKNOWN|unknown)$
diff --git a/test-cases/apparmor-tracker.yaml b/test-cases/apparmor-tracker.yaml
index 32efbce50d8e7fa5a0c6a1bca6049b328c4bbe79..b468189257b036fcbb8c559b53529a84706c70eb 100644
--- a/test-cases/apparmor-tracker.yaml
+++ b/test-cases/apparmor-tracker.yaml
@@ -54,7 +54,7 @@ run:
     - "# Execute the following commands:"
     - echo -n | sudo tee /var/log/audit/audit.log
     - common/run-test-in-systemd --name run-test-tracker --timeout 3000 apparmor/tracker/test-tracker
-    - sudo cat /var/log/audit/audit.log | aa_log_extract_tokens.pl PERMITTING REJECTING
+    - sudo journalctl -b -t audit -o cat | /usr/bin/aa_log_extract_tokens.sh ALLOWED DENIED
 
 parse:
   pattern: ^(?P<test_case_id>[\w\-\.]+):\s(?P<result>PASS|pass|FAIL|fail|SKIP|skip|UNKNOWN|unknown)$
diff --git a/test-cases/apparmor-utils.yaml b/test-cases/apparmor-utils.yaml
index 6ef2ed9b4e3a467a6806fd8340a4f564ea7aa077..ea8e95e9e5d867555bfa32412f093e14354cea0b 100644
--- a/test-cases/apparmor-utils.yaml
+++ b/test-cases/apparmor-utils.yaml
@@ -57,7 +57,7 @@ run:
     - echo -n | sudo tee /var/log/audit/audit.log
     - 'common/run-test-in-systemd --name=aa-enforce-test --timeout 90 -- sh /usr/lib/apparmor-utils-tests/aa-enforce-test.sh'
     - 'common/run-test-in-systemd --name=apparmor_parser --timeout 90 -- sh /usr/lib/apparmor-utils-tests/apparmor_parser.sh'
-    - sudo cat /var/log/audit/audit.log | aa_log_extract_tokens.pl PERMITTING REJECTING
+    - sudo journalctl -b -t audit -o cat | /usr/bin/aa_log_extract_tokens.sh ALLOWED DENIED
 
 parse:
   fixupdict: