# Af\_packet error on RHEL

**URL:** <https://discuss.elastic.co/t/af-packet-error-on-rhel/37314>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [December 16, 2015, 7:22am UTC](https://discuss.elastic.co/t/af-packet-error-on-rhel/37314 "2015-12-16T07:22:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcbilger](https://avatars.discourse-cdn.com/v4/letter/m/e47c2d/32.png) [@Marcbilger](https://discuss.elastic.co/u/Marcbilger)\
**Post date:** [December 16, 2015, 7:22am UTC](https://discuss.elastic.co/t/af-packet-error-on-rhel/37314/1 "2015-12-16T07:22:09Z")

</div>

Hi,

First, I'd like to thank you for the great job you're providing !

Here is my use case :  
I want to get DNS data into ELK (huge amount of packets/ sec).  
Packetbeat is installed on a dedicated server.

I installed Packetbeat (1.0.0 rpm for RHEL install)

Here is the RHEL release version:

> cat /etc/redhat-release  
> Red Hat Enterprise Linux Server release 6.7 (Santiago)

my packetbeat.yml

```
> interfaces:

> device: eth1

> with_vlans: true

> protocols:

> dns:

> ports: [53]

>    
> include_authorities: true

>    
> include_additionals: true

> output:

> logstash:

> hosts: ["localhost:5044"]

> worker: 2
```

When trying the af\_packet type in packetbeat.yml, I get the following error:

> 2015-12-15T14:27:59+01:00 CRIT Initializing sniffer failed:  
> Error creating sniffer: setsockopt packet\_rx\_ring: cannot allocate memory

I'm not a linux specialist, so please could you advise?

best regards.

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [December 16, 2015, 9:36am UTC](https://discuss.elastic.co/t/af-packet-error-on-rhel/37314/2 "2015-12-16T09:36:32Z")

</div>

Can you try dropping the caches, please:

```
 echo 3 > /proc/sys/vm/drop_caches

```

And check (e.g. with `free`) that you have at least 100 MB or so free. The af\_packet mode needs to allocate the whole buffer at startup.

---

<div class="post-metadata">

**Author:** ![Marcbilger](https://avatars.discourse-cdn.com/v4/letter/m/e47c2d/32.png) [@Marcbilger](https://discuss.elastic.co/u/Marcbilger)\
**Post date:** [December 16, 2015, 9:56am UTC](https://discuss.elastic.co/t/af-packet-error-on-rhel/37314/3 "2015-12-16T09:56:14Z")

</div>

Thx for the answer,  
performed. but I got the same CRIT error.  
Here is the free output.

> free -h  
> total used free shared buffers cached  
> Mem: 2.0G 448M 1.5G 4K 44M 41M  
> -/+ buffers/cache: 362M 1.6G  
> Swap: 1.0G 104M 919M

regards,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:57pm UTC](https://discuss.elastic.co/t/af-packet-error-on-rhel/37314/4 "2017-07-05T21:57:28Z")

</div>