# Auditbeat do not delete correctly

**URL:** <https://discuss.elastic.co/t/auditbeat-do-not-delete-correctly/297814>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [February 21, 2022, 9:27pm UTC](https://discuss.elastic.co/t/auditbeat-do-not-delete-correctly/297814 "2022-02-21T21:27:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tester854](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tester854/32/101366_2.png) [@Tester854](https://discuss.elastic.co/u/Tester854)\
**Post date:** [February 21, 2022, 9:27pm UTC](https://discuss.elastic.co/t/auditbeat-do-not-delete-correctly/297814/1 "2022-02-21T21:27:01Z")

</div>

Hi,

I noticed that deleting auditbeat with the parameter (backspressure\_strategy:kernel) audit rules continue to work. There are events from them in dmesg.

How to remove auditbeat using (backspressure\_strategy:kernel) properly?  
How to do this without restarting the system?

I found a ticket with this problem, but it is close

> <https://github.com/elastic/beats/issues/8280>
>
> Auditbeat doesn't flush auditd rules upon daemon exit. This leads to \`/var/log/k…ern.log\` getting flooded with all the audit messages.
> 
> Furthermore, it seems that auditbeat doesn't have a CLI option to flush the auditd rules.
> 
> It seems that auditd too doesn't flush rules on daemon exit.
> 
> \`\`\`
> \# systemctl start auditd
> 
> \# auditctl -l
> No rules
> 
> \# auditctl -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time\_change
> \# auditctl -l
> \-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time\_change
> 
> \# systemctl stop auditd
> 
> \# auditctl -l
> \-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time\_change
> \`\`\`
> 
> If flushing rules on daemon exit is not appropriate, then the auditbeat CLI shoould at least provide a way to flush the rules manually.
> 
> Details,
> 
> \- Version: Auditbeat 6.4.0
> \- Operating System: Ubuntu 16.04 LTS / 18.04 LTS

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2022, 11:27pm UTC](https://discuss.elastic.co/t/auditbeat-do-not-delete-correctly/297814/2 "2022-03-21T23:27:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.