# Auditbeat - 120% CPU? **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [May 29, 2020, 12:01pm UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909 "2020-05-29T12:01:40Z")\ **Posts on this page:** 11\ **Page:** 2
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [June 25, 2020, 7:54am UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/21 "2020-06-25T07:54:57Z")
> [@adrisr](#): > > -httpprof :8888 Also seen userland cpu spinning after a while in auditbeat with socket dataset enabled, will try without as well... I'm failing to restart auditbeat 7.8.0 with -httpprof :8888 added to the argument list: DAEMON\_ARGS="-httpprof :8888 ..." ``` root# service auditbeat restart * Restarting Auditbeat is a lightweight shipper for audits. auditbeat Error: unknown flag: --httpprof Usage: auditbeat test config [flags] Flags: -h, --help help for config Global Flags: -E, --E setting=value Configuration overwrite -c, --c string Configuration file, relative to path.config (default "auditbeat.yml") -d, --d string Enable certain debug selectors -e, --e Log to stderr and disable syslog/file output --environment environmentVar set environment the Beat is run in (default default) --path.config string Configuration path --path.data string Data path --path.home string Home path --path.logs string Logs path --plugin pluginList Load additional plugins --strict.perms Strict permission checking on config files (default true) -v, --v Log at INFO level [fail] ``` ---
**Author:** ![hazardousmonk](https://avatars.discourse-cdn.com/v4/letter/h/e5b9ba/32.png) [@hazardousmonk](https://discuss.elastic.co/u/hazardousmonk)\ **Post date:** [June 28, 2020, 1:36pm UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/22 "2020-06-28T13:36:28Z")
This may seem silly but I'm not able to upload a binary here, it's only allowing images. I can host it on another service and link it if you'd like. ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [June 29, 2020, 7:32am UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/23 "2020-06-29T07:32:33Z")
You might find a bit of similar info from the metricbeat' system.socket module ---
**Author:** ![btnrsec](https://avatars.discourse-cdn.com/v4/letter/b/9dc877/32.png) [@btnrsec](https://discuss.elastic.co/u/btnrsec)\ **Post date:** [June 29, 2020, 1:54pm UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/24 "2020-06-29T13:54:48Z")
I upgraded one system running auditbeat 7.6.1 (without socket issue) to auditbeat 7.8.0 and am getting high CPU usage. I had to disable the socket dataset to workaround. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [June 29, 2020, 2:46pm UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/25 "2020-06-29T14:46:23Z")
@hazardousmonk you can upload it somewhere else and send it to me via private msg if you prefer. @btnrsec can you provide a profile as suggested in [Auditbeat - 120% CPU?](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/16) ? ---
**Author:** ![ethrbunny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethrbunny/32/34603_2.png) [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Post date:** [June 30, 2020, 12:18pm UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/27 "2020-06-30T12:18:04Z")
(Im the OP) Definitely seeing the high CPU usage of auditbeat. Im having to kill it on a regular basis now. Im running `auditbeat-7.8.0-1.x86_64` ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [July 9, 2020, 9:00am UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/28 "2020-07-09T09:00:56Z")
@ethrbunny @btnrsec @stefws @hazardousmonk @mgotechlock @BenB196 We've identified the issue with 7.8.0 and have a [fix PR.](https://github.com/elastic/beats/pull/19764) Here's a snapshot build of 7.8.1 with the fix in the above PR: [https://drive.google.com/drive/folders/1V704wdgKaIKCci0aO1Bao8COAHhjKotp?usp=sharing](https://drive.google.com/drive/folders/1V704wdgKaIKCci0aO1Bao8COAHhjKotp?usp=sharing) Can you give it a try (with socket dataset enabled) and share the outcome? Thanks ---
**Author:** ![ethrbunny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethrbunny/32/34603_2.png) [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Post date:** [July 9, 2020, 10:53am UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/29 "2020-07-09T10:53:40Z")
I've installed it on a few systems. It will be a few days before I can tell whether it's behaving properly. ---
**Author:** ![ethrbunny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethrbunny/32/34603_2.png) [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Post date:** [July 10, 2020, 11:49am UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/30 "2020-07-10T11:49:06Z")
So far so good. ---
**Author:** ![ethrbunny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethrbunny/32/34603_2.png) [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Post date:** [July 11, 2020, 11:44am UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/31 "2020-07-11T11:44:14Z")
The auditbeat snapshot seems much better than the original. 7.8.0 is a v problematic release. I have nodes dropping out on a regular basis - something I've never seen before in the years I've been using elastic. Looking forward to 7.8.1+ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 1, 2020, 11:44am UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/32 "2020-08-01T11:44:16Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/auditbeat-120-cpu/234909.md?page=1)