# Audit Beat - Log to a file **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [May 13, 2018, 12:10am UTC](https://discuss.elastic.co/t/audit-beat-log-to-a-file/131597 "2018-05-13T00:10:00Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![daniel333](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel333/32/31140_2.png) [@daniel333](https://discuss.elastic.co/u/daniel333)\ **Post date:** [May 13, 2018, 12:10am UTC](https://discuss.elastic.co/t/audit-beat-log-to-a-file/131597/1 "2018-05-13T00:10:01Z")
All, First time working with anything from Elastic and I was starting with Auditbeat. I install the package and the default configuration works. But if I want to log to a file to test the FIM, auditbeats failes to start with this error > May 13 00:04:00 instance-1 systemd[1]: auditbeat.service: main process exited, code=exited, status=1/FAILURE > May 13 00:04:00 instance-1 systemd[1]: Unit auditbeat.service entered failed state. > May 13 00:04:00 instance-1 systemd[1]: auditbeat.service failed. > May 13 00:04:01 instance-1 systemd[1]: auditbeat.service holdoff time over, scheduling restart. > May 13 00:04:01 instance-1 systemd[1]: start request repeated too quickly for auditbeat.service > May 13 00:04:01 instance-1 systemd[1]: Failed to start auditbeat. > May 13 00:04:01 instance-1 systemd[1]: Unit auditbeat.service entered failed state. > May 13 00:04:01 instance-1 systemd[1]: auditbeat.service failed. I copied the config directly from the manual so maybe I am misunderstanding how these configs are supposed to look. > #------------------------------- File output ----------------------------------- > output.file: > enabled: true > path: "/tmp/auditbeat" > filename: auditbeat > rotate\_every\_kb: 10000 > number\_of\_files: 7 > permissions: 0600 Can you point me to where I might be going wrong on this one? ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [May 13, 2018, 12:40am UTC](https://discuss.elastic.co/t/audit-beat-log-to-a-file/131597/2 "2018-05-13T00:40:37Z")
hey can you enable debug logging and review the auditbeat.log for what is causing such. ref: [https://www.elastic.co/guide/en/beats/auditbeat/current/configuration-logging.html](https://www.elastic.co/guide/en/beats/auditbeat/current/configuration-logging.html) ---
**Author:** ![daniel333](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel333/32/31140_2.png) [@daniel333](https://discuss.elastic.co/u/daniel333)\ **Post date:** [May 13, 2018, 4:54am UTC](https://discuss.elastic.co/t/audit-beat-log-to-a-file/131597/3 "2018-05-13T04:54:42Z")
Thanks for replying so quickly. Found my problem shortly after posting. Seems you can't have the default output and a file output enabled at the same time. Once I disabled the default one it worked. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 5:22am UTC](https://discuss.elastic.co/t/audit-beat-log-to-a-file/131597/4 "2022-11-04T05:22:51Z")