# Auditbeat consuming almost 90% cpu some times

**URL:** <https://discuss.elastic.co/t/auditbeat-consuming-almost-90-cpu-some-times/242872>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [July 28, 2020, 9:42am UTC](https://discuss.elastic.co/t/auditbeat-consuming-almost-90-cpu-some-times/242872 "2020-07-28T09:42:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Khasim\_Soudagar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khasim_soudagar/32/47010_2.png) [@Khasim\_Soudagar](https://discuss.elastic.co/u/Khasim_Soudagar)\
**Post date:** [July 28, 2020, 9:42am UTC](https://discuss.elastic.co/t/auditbeat-consuming-almost-90-cpu-some-times/242872/1 "2020-07-28T09:42:15Z")

</div>

HI  
i'm using auditbeat:7.7.1-OSS as part of SIEM, following is the configuration we are following.

`audit\_rules: |  
-a always,exit -F arch=b64 -S execve,execveat -k exec  
-a always,exit -F arch=b64 -S accept,bind,connect -F key=external-access  
-w /etc/group -p wa -k identity  
-w /etc/passwd -p wa -k identity  
-w /etc/gshadow -p wa -k identity  
-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open\_by\_handle\_at -F exit=-EACCES -k access  
-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open\_by\_handle\_at -F exit=-EPERM -k access

- module: file\_integrity  
paths:
  - /bin
  - /usr/bin
  - /sbin
  - /usr/sbin
  - /etc
  - /boot
  - /var/log/
  - /opt/bin/
  - /opt/sbin/
  - /lib
  - /usr/lib
  - /usr/local/lib
  - /lib64
  - /usr/lib64
  - /root  
setup.template.settings:  
index.number\_of\_shards: 1  
setup.dashboards.enabled: true`

It is consuming almost 90% of the cpu in prod servers some times. can anyone help me on this.

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [August 2, 2020, 7:39pm UTC](https://discuss.elastic.co/t/auditbeat-consuming-almost-90-cpu-some-times/242872/2 "2020-08-02T19:39:25Z")

</div>

Experienced similar behaviour on some servers. Maybe gradually disable audit rules to find which audit rule or file integrity path consumes the most cpu?

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [August 3, 2020, 12:15am UTC](https://discuss.elastic.co/t/auditbeat-consuming-almost-90-cpu-some-times/242872/3 "2020-08-03T00:15:52Z")

</div>

This is a bug in Auditbeat that exists in 7.7.0, 7.7.1, and 7.8.0. It should be fixed in 7.8.1.

> <https://github.com/elastic/beats/issues/19141>
>
> Auditbeat 7.7.x with the System Module Socket Dataset enabled, will randomly start using 100%+ CPU on some servers. This was not...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2020, 2:16am UTC](https://discuss.elastic.co/t/auditbeat-consuming-almost-90-cpu-some-times/242872/4 "2020-08-31T02:16:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.