# Auditbeat - 120% CPU?

**URL:** <https://discuss.elastic.co/t/auditbeat-120-cpu/234909>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [May 29, 2020, 12:01pm UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909 "2020-05-29T12:01:40Z")\
**Posts on this page:** 1\
**Showing post:** 16

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [June 22, 2020, 4:27pm UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909/16 "2020-06-22T16:27:07Z")

</div>

@mgotechlock is it possible that the 7.7.1 service was still running after updating to 7.8.0 and just needed a restart.

@hazardousmonk I tried to reproduce with Debian 9, unsuccessfully. Can you share the logs running with `-d socket` ? (or `logging.selectors: [socket]` in _auditbeat.yml_). Try to have it run at least a couple of minutes after CPU goes 100%.

Also it'll be good to have a cpu profile, running auditbeat with the `-httpprof :8888` command-line option and then once it's using 100% CPU, fetch a profile with

> wget '[http://localhost:8888/debug/pprof/profile?seconds=30](http://localhost:8888/debug/pprof/profile?seconds=30)'

---

_[View the full topic](https://discuss.elastic.co/t/auditbeat-120-cpu/234909)._