# Auditbeat 7.4 crashing - too many open files

**URL:** <https://discuss.elastic.co/t/auditbeat-7-4-crashing-too-many-open-files/202653>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [October 8, 2019, 11:27am UTC](https://discuss.elastic.co/t/auditbeat-7-4-crashing-too-many-open-files/202653 "2019-10-08T11:27:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ethrbunny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethrbunny/32/34603_2.png) [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\
**Post date:** [October 8, 2019, 11:27am UTC](https://discuss.elastic.co/t/auditbeat-7-4-crashing-too-many-open-files/202653/1 "2019-10-08T11:27:18Z")

</div>

Seeing errors like these in journal:

```
Oct 02 18:26:50 hostname auditbeat[30239]: 2019-10-02T18:26:50.004Z ERROR instance/beat.go:878        
  Exiting: 1 error: 1 error: system/socket dataset setup failed: 
  unable to monitor probe p:tcp6_connect_in tcp_v6_connect 
  sock={{.P1}} laddra={{.INET_SOCK_V6_LADDR_A}}({{.P1}}){{.INET_SOCK_V6_TERM}} 
  laddrb={{.INET_SOCK_V6_LADDR_B}}({{.P1}}){{.INET_SOCK_V6_TERM}} 
  lport=+{{.INET_SOCK_LPORT}}({{.P1}}):u16 
  af=+{{.SOCKADDR_IN6_AF}}({{.P2}}):u16 
  addra=+{{.SOCKADDR_IN6_ADDRA}}({{.P2}}):u64 
  addrb=+{{.SOCKADDR_IN6_ADDRB}}({{.P2}}):u64 
  port=+{{.SOCKADDR_IN6_PORT}}({{.P2}}):u16: 
  perf_event_open: too many open files

```

It only seems to be impacting systems where I have iSCSI mounts though.

```
# uname -a
Linux hostname 3.10.0-957.12.2.el7.x86_64 #1 SMP Tue May 14 21:24:32 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

# cat /etc/redhat-release 
CentOS Linux release 7.6.1810 (Core)

# rpm -qa | grep auditbeat
**auditbeat** -7.4.0-1.x86_64

```

NOTE: ipv6 isn't used on these systems. Just v4.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [October 9, 2019, 3:01pm UTC](https://discuss.elastic.co/t/auditbeat-7-4-crashing-too-many-open-files/202653/2 "2019-10-09T15:01:12Z")

</div>

> [@ethrbunny](#):
>
> ```auto
> perf_event_open: too many open files
> 
> ```

Seems that you are hitting a limit on the number of file descriptors that auditbeat can use.

Can you check this limit (`ulimit -n`) and try with an increased value? (`ulimit -n newlimit`).

Are you running alongside the file\_integrity module? Can you share your `auditbeat.yml`? It might be an explanation for an abnormally high descriptor usage.

---

<div class="post-metadata">

**Author:** ![ethrbunny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethrbunny/32/34603_2.png) [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\
**Post date:** [October 13, 2019, 3:00pm UTC](https://discuss.elastic.co/t/auditbeat-7-4-crashing-too-many-open-files/202653/3 "2019-10-13T15:00:03Z")

</div>

Changing this setting seems to have fixed the problem:

socket.enable\_ipv6: false

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [October 14, 2019, 7:40am UTC](https://discuss.elastic.co/t/auditbeat-7-4-crashing-too-many-open-files/202653/4 "2019-10-14T07:40:48Z")

</div>

What you did is to reduce the number of file descriptors open by disabling a feature on the socket dataset. You may still have this problem in the future if you don't increase the maximum number of descriptors available to Auditbeat.

---

<div class="post-metadata">

**Author:** ![ethrbunny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethrbunny/32/34603_2.png) [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\
**Post date:** [October 14, 2019, 10:48pm UTC](https://discuss.elastic.co/t/auditbeat-7-4-crashing-too-many-open-files/202653/5 "2019-10-14T22:48:43Z")

</div>

Yikes. Ok. TY.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2019, 10:48pm UTC](https://discuss.elastic.co/t/auditbeat-7-4-crashing-too-many-open-files/202653/6 "2019-11-04T22:48:47Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.