# Test pxar exclusion order with a bounded archive fixture > pxar applies exclusion patterns in order, with later patterns overriding earlier ones; test quoted patterns against a small file population before backup use. - Canonical URL: https://update.dsesecurity.com/updates/test-pxar-exclusion-order-with-a-bounded-archive-fixture/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-29T00:09:59+00:00 - Modified: 2026-10-29T00:10:35+00:00 - Last reviewed by DSE: 2026-10-28 - Resource type: Guide - DSE priority: Advisory - Topics: Business Continuity, IT - Reading time: 3 minutes ## What you need to know pxar applies exclusion patterns in order, with later patterns overriding earlier ones; test quoted patterns against a small file population before backup use. ## Potentially affected Proxmox pxar archive creation with command-line exclusion patterns or .pxarexclude files; verify installed tool and intended file population. ## DSE recommendation DSE recommends a disposable file fixture with an explicit expected archive list before adopting ordered pxar exclusion patterns. ## Article Bottom line: Make the intended file population explicit before writing exclusion patterns. Review their order and shell quoting against a small disposable example so the accepted archive list reflects the operator’s decision rather than a plausible-looking command. ## Source fact: what the authority says The [pxar command-line guide](https://pbs.proxmox.com/docs/pxar-tool.html) supports repeated --exclude arguments with gitignore-style patterns and negated patterns prefixed by !. It says later glob patterns override earlier ones, so reordering the same patterns can change the result. The guide warns that the shell can expand glob patterns before pxar receives them and requires correct quoting. It also supports .pxarexclude files with one pattern per line, and documents pxar list for inspecting archive paths. ## What the source does not establish This article concerns path-pattern interpretation in a new archive. It does not settle mounted-filesystem coverage, application consistency or modifications to an existing backup history. DSE keeps those decisions outside the small exclusion fixture and does not treat an archive listing as a complete restoration test. ## Applicability questions - Which paths must be retained, which must be omitted, and what exceptions are intentional? - Are command-line arguments, an exclusion file or both part of the reviewed invocation? - What shell and installed pxar version will execute the actual job? - Who will compare the resulting file list with an independently written expectation? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. DSE recommends a proposed fixture containing a text file to omit, a specifically retained text-file exception, a non-text file to keep and a nested directory. Use harmless distinct contents and write the expected archive paths first. Choose the example names as test inputs; do not use sensitive production data merely to make the fixture realistic. Review the ordered pattern set beside that expectation. Preserve the literal quoting as part of the invocation and have another operator explain which rule decides each proposed path. If an exclusion file is used, record its exact bytes with the command. Keep the exception after the broader exclusion only when that ordering expresses the intended decision. Create a separately named disposable archive for the rehearsal. Compare the actual listing with the expected list before adding more patterns. When a difference appears, change one pattern or its position at a time and retain the reason. Do not broaden filesystem traversal or alter production backup retention as a shortcut for resolving an exclusion mismatch. Include a proposed reversal of the broad exclusion and narrow exception as a paper comparison before the run. Have the reviewer predict the affected path from the documented ordering rule. Preserve the selected order with the fixture instead of sorting the patterns for appearance. ## Verification and evidence Proposed verification: inspect the new archive with the documented listing command and compare every fixture path with its expected inclusion state. Include the retained exception and nested path explicitly. Record the actual shell, tool version, command, exclusion-file identifier and listing so the review can distinguish argument handling from intended pattern order. Extract the retained harmless files to a separate approved test destination and compare their contents with the fixture. Keep inclusion evidence distinct from that limited recovery observation. Obtain the backup owner’s acceptance of the selected population before using the patterns in a live job, then revisit the fixture whenever the pattern set changes. ## Official references - [Proxmox Backup Server — pxar Command-line Tool](https://pbs.proxmox.com/docs/pxar-tool.html) — official product documentation; confirm the installed release and configuration. Source review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change. ## Primary reference - Name: Proxmox Backup Server — pxar Command-line Tool - Authority: pbs.proxmox.com - URL: https://pbs.proxmox.com/docs/pxar-tool.html - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Test pxar exclusion order with a bounded archive fixture,” DSE Security, https://update.dsesecurity.com/updates/test-pxar-exclusion-order-with-a-bounded-archive-fixture/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.