# Auditbeat btmp file monitoring glitch (saved size or offset illogical)
**URL:** https://discuss.elastic.co/t/auditbeat-btmp-file-monitoring-glitch-saved-size-or-offset-illogical/332037
**Category:** Beats
**Tags:** auditbeat
**Created:** [May 1, 2023, 6:47pm UTC](https://discuss.elastic.co/t/auditbeat-btmp-file-monitoring-glitch-saved-size-or-offset-illogical/332037 "2023-05-01T18:47:55Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Daniel314](https://discuss.elastic.co/u/Daniel314)
#### Post date: [May 1, 2023, 6:47pm UTC](https://discuss.elastic.co/t/auditbeat-btmp-file-monitoring-glitch-saved-size-or-offset-illogical/332037/1 "2023-05-01T18:47:55Z")
Hi,
I have auditbeat 7.17.8 installed on an RHEL 7 system. RHEL7 rotates out the BTMP file out at the start of every month. So, starting today I am seeing the following message every few seconds in syslog:
May 1 12:44:38 MYHOSTNAME auditbeat[14159]: WARN [login] login/utmp.go:191 saved size or offset illogical (new={Inode:34395525 Path:/var/log/btmp Size:0 Offset:1488768 Type:1}, saved={Inode:34395525 Path:/var/log/btmp Size:0 Offset:1488768 Type:1}) - reading whole file.
Restarting auditbeat didn't resolve this issue, and the current btmp filesize is indeed zero according to 'ls'.
I'm assuming this is a corner case/bug the programmers forgot to account for, but was wondering if anyone had any feedback/thoughts before I opened an issue for it on Github?
Thanks,
```
- Daniel
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 29, 2023, 8:48pm UTC](https://discuss.elastic.co/t/auditbeat-btmp-file-monitoring-glitch-saved-size-or-offset-illogical/332037/2 "2023-05-29T20:48:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.