audit: PROCTITLE proctitle=”ebtables-restore” spam in dmesg: silence it without disabling the firewall

Those audit: PROCTITLE proctitle="ebtables-restore" lines flooding dmesg come from pve-firewall reloading its rules. Every time Proxmox updates the firewall, ebtables-restore runs and auditd logs it. The fix is a one-line audit rule that drops just those records.

Why it happens

Proxmox VE uses pve-firewall to manage iptables and ebtables rules. When the firewall reloads — after a VM starts, a rule changes, or on a schedule — it invokes ebtables-restore to apply the bridge rules. Auditd is set to log all execve calls, so each invocation generates a PROCTITLE record with the full command line. That’s the spam you see.

The fix

Add an audit rule that excludes ebtables-restore from execve logging. Create a new rule file:

cat > /etc/audit/rules.d/ignore-ebtables-restore.rules <<EOF
-a always,exclude -F exe=/sbin/ebtables-restore
EOF

Then restart auditd to load it:

systemctl restart auditd

Check that the rule is active:

auditctl -l | grep ebtables-restore

You should see the exclude rule listed. Now dmesg stays clean, and the firewall keeps working. No need to disable auditd or pve-firewall.

If the spam continues

Sometimes the path is different, like /usr/sbin/ebtables-restore. Verify the exact path from the log line, then adjust the rule. You can also use a broader match on the executable name:

-a always,exclude -F exe=/usr/sbin/ebtables-restore

This is a Proxmox-specific annoyance, but the same approach works for any noisy audit event. Just make sure you’re filtering precisely, not turning off auditing altogether.

My take

Auditd is useful, but default logging of every execve is overkill for a homelab. Filter the noise, keep the signal. If you’re dealing with other Proxmox quirks, check out Proxmox Unresponsive After 1 or 2 Days: Check the Kernel Ring Buffer First — dmesg is often the first place to look.