Those audit: PROCTITLE proctitle="ebtables-restore" lines flooding dmesg come from pve-firewall reloading its rules. Every time Proxmox updates the firewall, ebtables-restore runs and auditd logs it. The fix is a one-line audit rule that drops just those records.
Why it happens
Proxmox VE uses pve-firewall to manage iptables and ebtables rules. When the firewall reloads — after a VM starts, a rule changes, or on a schedule — it invokes ebtables-restore to apply the bridge rules. Auditd is set to log all execve calls, so each invocation generates a PROCTITLE record with the full command line. That’s the spam you see.
The fix
Add an audit rule that excludes ebtables-restore from execve logging. Create a new rule file:
cat > /etc/audit/rules.d/ignore-ebtables-restore.rules <<EOF
-a always,exclude -F exe=/sbin/ebtables-restore
EOFThen restart auditd to load it:
systemctl restart auditdCheck that the rule is active:
auditctl -l | grep ebtables-restoreYou should see the exclude rule listed. Now dmesg stays clean, and the firewall keeps working. No need to disable auditd or pve-firewall.
If the spam continues
Sometimes the path is different, like /usr/sbin/ebtables-restore. Verify the exact path from the log line, then adjust the rule. You can also use a broader match on the executable name:
-a always,exclude -F exe=/usr/sbin/ebtables-restore
This is a Proxmox-specific annoyance, but the same approach works for any noisy audit event. Just make sure you’re filtering precisely, not turning off auditing altogether.
My take
Auditd is useful, but default logging of every execve is overkill for a homelab. Filter the noise, keep the signal. If you’re dealing with other Proxmox quirks, check out Proxmox Unresponsive After 1 or 2 Days: Check the Kernel Ring Buffer First — dmesg is often the first place to look.
