# Auditbeat 8.11 does not provide container id without privilege mode when cgroup v2 is enabled

**URL:** <https://discuss.elastic.co/t/auditbeat-8-11-does-not-provide-container-id-without-privilege-mode-when-cgroup-v2-is-enabled/346901>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [November 11, 2023, 2:28am UTC](https://discuss.elastic.co/t/auditbeat-8-11-does-not-provide-container-id-without-privilege-mode-when-cgroup-v2-is-enabled/346901 "2023-11-11T02:28:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![deva\_raj1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deva_raj1/32/124284_2.png) [@deva\_raj1](https://discuss.elastic.co/u/deva_raj1)\
**Post date:** [November 11, 2023, 2:28am UTC](https://discuss.elastic.co/t/auditbeat-8-11-does-not-provide-container-id-without-privilege-mode-when-cgroup-v2-is-enabled/346901/1 "2023-11-11T02:28:04Z")

</div>

```auto
Auditbeat 8.11 throughs error when installed as k8 daemonset with cgroup v2 .

DEBUG [gosigar_cid_provider] add_process_metadata/gosigar_cid_provider.go:63 failed to get cgroups for pid=1395: failed to read cgroups for pid=1395: error fetching cgroupV2 controllers.

It works only when `priveledged : true` is set . we have tried several other options such as running as root but still no go . Does auditbeat need to run in privileged mode to get container id information ?

        securityContext:
          runAsUser: 0
          # If using Red Hat OpenShift uncomment this:
          #privileged: true
          capabilities:
            add:
              # Capabilities needed for auditd module
              # - 'AUDIT_READ'
              # - 'AUDIT_WRITE'
              # - 'AUDIT_CONTROL'
              - 'ALL'

Please find the process config 

- add_process_metadata:
      match_pids: ['process.pid']
      include_fields: ['container.id']
    # cgroup_regex: '^.+cri-containerd.([0-9a-f]{64}).*'
    # cgroup_cache_expire_time: "0"
  - add_kubernetes_metadata:
      host: ${NODE_NAME}
      default_indexers.enabled: false
      default_matchers.enabled: false
      indexers:
        - container:
      # - pod_name:
      matchers:
        - fields.lookup_fields: ['container.id']

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 9, 2023, 4:28am UTC](https://discuss.elastic.co/t/auditbeat-8-11-does-not-provide-container-id-without-privilege-mode-when-cgroup-v2-is-enabled/346901/2 "2023-12-09T04:28:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.