# Auditbeat Exclusion of Process

**URL:** <https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [December 24, 2025, 9:25am UTC](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243 "2025-12-24T09:25:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![testtest](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/testtest/32/137049_2.png) [@testtest](https://discuss.elastic.co/u/testtest)\
**Post date:** [December 24, 2025, 9:25am UTC](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243/1 "2025-12-24T09:25:03Z")

</div>

Hi All,

Could someone help me with exclude any process executable related to this path

/usr/local/manageengine/uems\_agent/bin/\*

(I can see a lot of incoming logs related to

/usr/local/manageengine/uems\_agent/bin/dcpatchscan

/usr/local/manageengine/uems\_agent/bin/dcconfig

/usr/local/manageengine/uems\_agent/bin/dcservice

/usr/local/manageengine/uems\_agent/bin/ **dcinventory**

/usr/local/manageengine/uems\_agent/bin/dcondemand

appreciate your help!

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [December 24, 2025, 10:18am UTC](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243/2 "2025-12-24T10:18:32Z")

</div>

Hello @testtest

Welcome to the Community!!

We can use drop\_event in the yaml :

> **[auditbeat.reference.yml | Auditbeat Reference \[8.19\] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/8.19/auditbeat-reference-yml.html)**

Example :

> [@Auditbeat 7.3: Как добавить исключение auditd](https://discuss.elastic.co/t/auditbeat-7-3-auditd/205874/3):
>
> Игорь, спасибо за идею. Добавил процессор, но получил ошибку: Но и тут я получил ошибку: "Exiting: error initializing processors: each processor must have exactly one action, but found 2 actions (drop\_event,when)"

Thanks!!

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [December 27, 2025, 1:31pm UTC](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243/3 "2025-12-27T13:31:27Z")

</div>

If your post is about the auditd module, then you can filter events with exclude rules on the `exe`. These rules should be placed early in your rules list.

```wasm
-A exclude,always -F exe=/usr/local/manageengine/uems_agent/bin/dcpatchscan
-A exclude,always -F exe=/usr/local/manageengine/uems_agent/bin/dcconfig
-A exclude,always -F exe=/usr/local/manageengine/uems_agent/bin/dcservice
-A exclude,always -F exe=/usr/local/manageengine/uems_agent/bin/dcinventory
-A exclude,always -F exe=/usr/local/manageengine/uems_agent/bin/dcondemand

```