diff --git a/ipatests/azure/Dockerfiles/seccomp.json b/ipatests/azure/Dockerfiles/seccomp.json
index d5a5631fa..350f1b4fa 100644
--- a/ipatests/azure/Dockerfiles/seccomp.json
+++ b/ipatests/azure/Dockerfiles/seccomp.json
@@ -1,5 +1,6 @@
 {
-	"defaultAction": "SCMP_ACT_ERRNO",
+	"__defaultAction": "Change defaultAction to SCMP_ACT_LOG and then check Host's journal for SECCOMP",
+        "defaultAction": "SCMP_ACT_ERRNO",
 	"archMap": [
 		{
 			"architecture": "SCMP_ARCH_X86_64",
diff --git a/ipatests/azure/templates/test-jobs.yml b/ipatests/azure/templates/test-jobs.yml
index 69637c287..013262562 100644
--- a/ipatests/azure/templates/test-jobs.yml
+++ b/ipatests/azure/templates/test-jobs.yml
@@ -64,6 +64,16 @@ steps:
     HOST_JOURNAL_PATH="${IPA_TESTS_ENV_WORKING_DIR}/${HOST_JOURNAL}.tar.gz"
     sudo journalctl -b | tee "$HOST_JOURNAL"
 
+    function emit_warning() {
+        printf "##vso[task.logissue type=warning]%s\n" "$1"
+    }
+
+    printf "AVC:\n"
+    grep 'AVC apparmor="DENIED"' "$HOST_JOURNAL" && \
+        emit_warning "There are Host's AVCs. Please, check the logs."
+    printf "SECCOMP:\n"
+    grep ' SECCOMP ' "$HOST_JOURNAL" && \
+        emit_warning "There are reported SECCOMP syscalls. Please, check the logs."
     tar --ignore-failed-read -czf "$HOST_JOURNAL_PATH" "$HOST_JOURNAL"
   condition: succeededOrFailed()
   displayName: Host's systemd journal