# Auditbeat 7.7.0 fails to start on Kubuntu

**URL:** <https://discuss.elastic.co/t/auditbeat-7-7-0-fails-to-start-on-kubuntu/235004>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [May 30, 2020, 8:00am UTC](https://discuss.elastic.co/t/auditbeat-7-7-0-fails-to-start-on-kubuntu/235004 "2020-05-30T08:00:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![parthmaniar](https://avatars.discourse-cdn.com/v4/letter/p/71e660/32.png) [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Post date:** [May 30, 2020, 8:00am UTC](https://discuss.elastic.co/t/auditbeat-7-7-0-fails-to-start-on-kubuntu/235004/1 "2020-05-30T08:00:45Z")

</div>

I am trying to run auditbeat on Kubuntu (20.04 LTS), however it keeps crashing. There is no configuration inside audit.rules.d/. However crash reason seems to be something else:

```auto
    May 30 13:13:01 HOSTNAME auditbeat[11745]: 2020-05-30T13:13:01.411+0530#011INFO#011instance/beat.go:411#011auditbeat stopped.
    May 30 13:13:01 HOSTNAME auditbeat[11745]: 2020-05-30T13:13:01.411+0530#011ERROR#011instance/beat.go:932#011Exiting: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess_inet6_csk_xmit failed: failed to add kprobe 'r:inet_csk_accept_guess inet_csk_accept sock={{.RET}}': failed installing probe 'r:auditbeat/inet_csk_accept_guess inet_csk_accept sock=%ax': write /sys/kernel/tracing/kprobe_events: file exists
    May 30 13:13:01 HOSTNAME auditbeat[11745]: Exiting: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess_inet6_csk_xmit failed: failed to add kprobe 'r:inet_csk_accept_guess inet_csk_accept sock={{.RET}}': failed installing probe 'r:auditbeat/inet_csk_accept_guess inet_csk_accept sock=%ax': write /sys/kernel/tracing/kprobe_events: file exists
    May 30 13:13:01 HOSTNAME systemd[1]: auditbeat.service: Main process exited, code=exited, status=1/FAILURE
    May 30 13:13:01 HOSTNAME systemd[1]: auditbeat.service: Failed with result 'exit-code'.
    May 30 13:13:01 HOSTNAME kernel: [2796.313920] audit: type=1131 audit(1590824581.469:1047): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=auditbeat comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
    May 30 13:13:01 HOSTNAME systemd[1]: auditbeat.service: Scheduled restart job, restart counter is at 1.

```

Could someone kindly guide me?

---

<div class="post-metadata">

**Author:** ![Andre\_Letterer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andre_letterer/32/42248_2.png) [@Andre\_Letterer](https://discuss.elastic.co/u/Andre_Letterer)\
**Post date:** [May 30, 2020, 10:28pm UTC](https://discuss.elastic.co/t/auditbeat-7-7-0-fails-to-start-on-kubuntu/235004/2 "2020-05-30T22:28:18Z")

</div>

You ran into IPv6 issue.  
I assume like I did in my test.  
If you look into

```auto
/etc/sysctl.conf

```

Please have a look if you have configured:

```auto
net.ipv6.conf.all.disable_ipv6 = 1

```

In theory it should be enough if you just enable IPv6 for `lo` interface and add this line to `/etc/sysctl.conf` and reboot the machine:

```auto
net.ipv6.conf.lo.disable_ipv6 = 0

```

Please let me know if this helped.

---

<div class="post-metadata">

**Author:** ![parthmaniar](https://avatars.discourse-cdn.com/v4/letter/p/71e660/32.png) [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Post date:** [June 1, 2020, 5:29pm UTC](https://discuss.elastic.co/t/auditbeat-7-7-0-fails-to-start-on-kubuntu/235004/3 "2020-06-01T17:29:37Z")

</div>

This worked perfectly. I however used GUI to ignore IPv6 on network connections. 🙂

---

<div class="post-metadata">

**Author:** ![Andre\_Letterer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andre_letterer/32/42248_2.png) [@Andre\_Letterer](https://discuss.elastic.co/u/Andre_Letterer)\
**Post date:** [June 1, 2020, 9:14pm UTC](https://discuss.elastic.co/t/auditbeat-7-7-0-fails-to-start-on-kubuntu/235004/4 "2020-06-01T21:14:56Z")

</div>

Yes, the beats are programmed in Golang, and it seems that this can even be an issue on the Golang implementation level. I am not sure, but I found some similar issues on other repositories working around this in a similar manner.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2020, 9:15pm UTC](https://discuss.elastic.co/t/auditbeat-7-7-0-fails-to-start-on-kubuntu/235004/5 "2020-06-22T21:15:01Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.