journalctl flooded with kernel: audit: messages

[Raspdomo]

Configuration:

• raspberry pi 4, bookworm, all updates done
• Domoticz v2024.7 (latest stable)
• mosquitto MQTT
• npm (10.9.2) and node (v22.14.0)
• zwave-js-ui (9.7.1.04fdaf5) and zwave-js (12.4.1), installed with snap
  (pls don't start a docker<>snap discussion, that's not the point here)
  (I adhere to the principle "don't touch it if it works well" so I have not installed the latest version - yet)

Everything works well - no problems at all... although journalctl tells another story.
Every single second there are several journal entries like these, generating 100+MB of logging per day (fortunately it all runs on an SSD, not an SD card...):

feb 27 10:16:11 raspberrypi audit[1394]: SECCOMP auid=4294967295 uid=0 gid=0 ses=4294967295 pid=1394 comm="node" exe="/snap/zwave-js-ui/332/bin/node" sig=0 arch=c00000b7 syscall=426 compat=0 >
feb 27 10:16:11 raspberrypi kernel: audit: type=1326 audit(1740647771.603:595): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=1394 comm="node" exe="/snap/zwave-js-ui/332/bin/node" sig=0 arch>
feb 27 10:16:11 raspberrypi audit[1394]: SECCOMP auid=4294967295 uid=0 gid=0 ses=4294967295 pid=1394 comm="node" exe="/snap/zwave-js-ui/332/bin/node" sig=0 arch=c00000b7 syscall=426 compat=0 >
feb 27 10:16:11 raspberrypi kernel: audit: type=1326 audit(1740647771.791:596): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=1394 comm="node" exe="/snap/zwave-js-ui/332/bin/node" sig=0 arch>

ps -ef shows two lines related to "node":

root        1393     862  0 10:13 ?        00:00:00 sh -c node --preserve-symlinks server/bin/www.js
root        1394    1393 24 10:13 ?        00:00:28 node --preserve-symlinks server/bin/www.js

After many hours of research (I'm not a linux expert at all) I finally succeeded in suppressing this flooding of the logging by installing auditd and creating an audit rule to exclude these lines (-a never,exclude -F exe=/snap/zwave-js-ui/332/bin/node), and I also stopped/masked systemd-journald-audit.socket.

But that handles the symptom, not the cause. Anybody got any ideas ?

[robertsLando]

sincerely those logs don't tell much to me, would be curious to know if the same issue applies when using other deploy methods in order to understand if it's only snap related

cc @jmgiaever

[Raspdomo]

Seems to come from /snap/zwave-js-ui/332/bin/node causing a syscall=426.

Some googling via https://gpages.juszkiewicz.com.pl/syscalls-table/syscalls.html
leads to https://www.man7.org/linux/man-pages/man2/io_uring_enter.2.html: initiate and/or complete asynchronous I/O.

For me that's about as comprehensible as chinese, but maybe it rings a bell for you.

[jmgiaever]

Hi,

I'm not seeing these on official Ubuntu versions. Tested on both Server and Core.