Audit beat warning

Elastic Stack Beats
1

Hi Im seeing the following warning when I started auditbeat can someone please help me resolve the following issue thanks.

' feb 28 15:45:11 virtual-machine auditbeat[4659]: 2021-02-28T15:45:11.932Z WARN [process] process/process.go:249 failed to hash executable /usr/share/metricbeat/bin/metricbeat for PID 2924: failed to hash file /usr/share/metricbeat/bin/metricbeat: hasher: file size 135326592 '

3

I just wanted to check if this is indeed solved, given you deleted the post with the flagged solution

4

I think has solved the issue in audit.reference.yml by changing process.hash.max_file_size.

5

Yes, max_file_size should solve this. See File Integrity Module | Auditbeat Reference [7.11] | Elastic. It won't hash files larger than 100MiB by default.