# Auditbeat 7.11 on Ubuntu doesn't read /var/log/btmp
**URL:** https://discuss.elastic.co/t/auditbeat-7-11-on-ubuntu-doesnt-read-var-log-btmp/264092
**Category:** Beats
**Tags:** auditbeat
**Created:** [February 12, 2021, 8:26am UTC](https://discuss.elastic.co/t/auditbeat-7-11-on-ubuntu-doesnt-read-var-log-btmp/264092 "2021-02-12T08:26:50Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Supp0rt](https://discuss.elastic.co/u/Supp0rt)
#### Post date: [February 12, 2021, 8:26am UTC](https://discuss.elastic.co/t/auditbeat-7-11-on-ubuntu-doesnt-read-var-log-btmp/264092/1 "2021-02-12T08:26:50Z")
Hi,
I installed auditbeat 7.11.2 on Ubuntu 16.04 and Centos 7 to read login from file `/var/log/wtmp`
and `/var/log/btmp` .
On Centos 7 all registers are read correctly.
On Ubuntu, only login and logout are collected. No entry for logfail (the entries in` /var/log/btmp`).
Auditbeat on Ubuntu seems not to read this event and not send it to elasticsearch
What could be the problem?
I am also attaching the auditbeat.yml configuration. The file is the same both Centos and Ubuntu.
```auto
auditbeat.modules:
- module: system
datasets:
- login # User logins, logouts, and system boots.
state.period: 12h
period: 30s
user.detect_password_changes: true
login.wtmp_file_pattern: /var/log/wtmp*
login.btmp_file_pattern: /var/log/btmp*
setup.template.settings:
index.number_of_shards: 1
setup.kibana:
host: "xxx.xxx.xxx.xxx:5601"
username: "username"
password: "password"
#space.id:
output.elasticsearch:
hosts: ["xxx.xxx.xxx.xxx:9200"]
username: "username"
password: "password"
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2021, 10:26am UTC](https://discuss.elastic.co/t/auditbeat-7-11-on-ubuntu-doesnt-read-var-log-btmp/264092/2 "2021-03-12T10:26:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.