# Auditbeat failed to create audit client & failed to get audit status: operation not permitted

**URL:** <https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/231417>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [May 6, 2020, 9:53pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/231417 "2020-05-06T21:53:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Luis\_Pereira1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_pereira1/32/43046_2.png) [@Luis\_Pereira1](https://discuss.elastic.co/u/Luis_Pereira1)\
**Post date:** [May 6, 2020, 9:53pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/231417/1 "2020-05-06T21:53:28Z")

</div>

Hello,

I'm trying to get my Auditbeat running and I keep getting this error:

> Exiting: 1 error: 1 error: failed to create audit client: failed to get audit status: operation not permitted

My Auditbeat config looks like this:

```
  auditbeat:
    image: docker.elastic.co/beats/auditbeat:7.6.2
    pid: host
    cap_add:
      - AUDIT_CONTROL
      - AUDIT_READ
    command: -e -E 'output.elasticsearch.password=changeme'
    configs:
      - source: auditb_config.v3
        target: /usr/share/auditbeat/auditbeat.yml
    privileged: true
    networks:
      - elastic_elknet

```

When I deploy the stack I have this warning the beginning of the deployment:

Ignoring unsupported options: cap\_add, pid, privileged.

I'm running my yml file on version 3.7

Any suggestions would be appreciated,  
Thanks

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 7, 2020, 3:30pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/231417/2 "2020-05-07T15:30:57Z")

</div>

> [@Luis\_Pereira1](#):
>
> Ignoring unsupported options: cap\_add, pid, privileged.

Sounds like the container isn't running with the required capabilities because something went wrong. You can probably check this by using `docker inspect` to look at the running container. Or at an ever lower level with `getpcaps "$(pgrep auditbeat)"` on the host machine.

I guess there's an issue with the docker-compose file.

---

<div class="post-metadata">

**Author:** ![Luis\_Pereira1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_pereira1/32/43046_2.png) [@Luis\_Pereira1](https://discuss.elastic.co/u/Luis_Pereira1)\
**Post date:** [May 7, 2020, 10:54pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/231417/3 "2020-05-07T22:54:30Z")

</div>

Hi Andrew,

My Auditbeat compose file looks like this:

```
  auditbeat:
    image: docker.elastic.co/beats/auditbeat:7.6.2
    user: root
    pid: host
    cap_add:
      - AUDIT_CONTROL
      - AUDIT_READ
    command: -e -E 'output.elasticsearch.password=changeme'
    configs:
      - source: auditb_config.v3
        target: /usr/share/auditbeat/auditbeat.yml
    privileged: true
    networks:
      - elastic_elknet

```

When I ran the command getpcaps, I get the following

`Capabilities for `': = cap\_chown,cap\_dac\_override,cap\_dac\_read\_search,cap\_fowner,cap\_fsetid,cap\_kill,cap\_setgid,cap\_setuid,cap\_setpcap,cap\_linux\_immutable,cap\_net\_bind\_service,cap\_net\_broadcast,cap\_net\_admin,cap\_net\_raw,cap\_ipc\_lock,cap\_ipc\_owner,cap\_sys\_module,cap\_sys\_rawio,cap\_sys\_chroot,cap\_sys\_ptrace,cap\_sys\_pacct,cap\_sys\_admin,cap\_sys\_boot,cap\_sys\_nice,cap\_sys\_resource,cap\_sys\_time,cap\_sys\_tty\_config,cap\_mknod,cap\_lease,cap\_audit\_write,cap\_audit\_control,cap\_setfcap,cap\_mac\_override,cap\_mac\_admin,cap\_syslog,cap\_wake\_alarm,cap\_block\_suspend,cap\_audit\_read+ep`

For what I've found on the forums I think its a problem with swarm and accepting this environment variables.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 7, 2020, 10:59pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/231417/4 "2020-05-07T22:59:41Z")

</div>

Yep, swarm issue.

From the docker-compose docs:

> > Note when using docker stack deploy
> 
> The `cap_add` and `cap_drop` options are ignored when [deploying a stack in swarm mode](https://docs.docker.com/engine/reference/commandline/stack_deploy/)

- [Overview | Docker Docs](https://docs.docker.com/compose/compose-file/#cap_add-cap_drop)

---

<div class="post-metadata">

**Author:** ![Luis\_Pereira1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_pereira1/32/43046_2.png) [@Luis\_Pereira1](https://discuss.elastic.co/u/Luis_Pereira1)\
**Post date:** [May 7, 2020, 11:07pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/231417/5 "2020-05-07T23:07:58Z")

</div>

Thank you anyway for confirming my suspicions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 28, 2020, 11:08pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/231417/6 "2020-05-28T23:08:07Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.