# AuditBeat failed to create audit client: protocol not supported **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [July 4, 2018, 6:05pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-protocol-not-supported/138601 "2018-07-04T18:05:09Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Nicholas\_Amon](https://avatars.discourse-cdn.com/v4/letter/n/a183cd/32.png) [@Nicholas\_Amon](https://discuss.elastic.co/u/Nicholas_Amon)\ **Post date:** [July 4, 2018, 6:05pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-protocol-not-supported/138601/1 "2018-07-04T18:05:09Z")
Auditbeat is failing to start successfully with the error message: 2018-07-04T18:01:32.410Z ERROR instance/beat.go:691 Exiting: 1 error: 1 error: failed to create audit client: failed to create audit client: protocol not supported I ran it in debug mode with the following command: auditbeat -c /etc/auditbeat/auditbeat.yml -e -d "\*" Below is the output: 2018-07-04T18:01:32.403Z INFO instance/beat.go:492 Home path: [/usr/share/auditbeat] Config path: [/etc/auditbeat] Data path: [/var/lib/auditbeat] Logs path: [/var/log/auditbeat] 2018-07-04T18:01:32.403Z DEBUG [beat] instance/beat.go:519 Beat metadata path: /var/lib/auditbeat/meta.json 2018-07-04T18:01:32.403Z INFO instance/beat.go:499 Beat UUID: 78cc0659-5e94-4cd7-8442-b75310dc37c4 2018-07-04T18:01:32.403Z INFO [beat] instance/beat.go:716 Beat info {"system\_info": {"beat": {"path": {"config": "/etc/auditbeat", "data": "/var/lib/auditbeat", "home": "/usr/share/auditbeat", "logs": "/var/log/auditbeat"}, "type": "auditbeat", "uuid": "78cc0659-5e94-4cd7-8442-b75310dc37c4"}}} 2018-07-04T18:01:32.403Z INFO [beat] instance/beat.go:725 Build info {"system\_info": {"build": {"commit": "a04cb664d5fbd4b1aab485d1766f3979c138fd38", "libbeat": "6.3.0", "time": "2018-06-11T22:49:45.000Z", "version": "6.3.0"}}} 2018-07-04T18:01:32.404Z INFO [beat] instance/beat.go:728 Go runtime info {"system\_info": {"go": {"os":"linux","arch":"amd64","max\_procs":1,"version":"go1.9.4"}}} 2018-07-04T18:01:32.404Z INFO [beat] instance/beat.go:732 Host info {"system\_info": {"host": {"architecture":"x86\_64","boot\_time":"2018-07-04T16:34:27Z","containerized":true,"hostname":"XXXXX","ips":["127.0.0.1/8","::1/128","10.0.3.15/24","fe80::a00:27ff:fedf:c384/64","192.168.97.97/24","fe80::a00:27ff:fe0e:fe11/64"],"kernel\_version":"3.16.39+pam02","mac\_addresses":["08:00:27:df:c3:84","08:00:27:0e:fe:11"],"os":{"family":"debian","platform":"debian","name":"Debian GNU/Linux","version":"8 (jessie)","major":8,"minor":0,"patch":0,"codename":"jessie"},"timezone":"UTC","timezone\_offset\_sec":0,"id":"90ad79efd626481e99c15419491a7edf"}}} 2018-07-04T18:01:32.405Z INFO [beat] instance/beat.go:761 Process info {"system\_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"effective":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"bounding":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"ambient":null}, "cwd": "/root", "exe": "/usr/share/auditbeat/bin/auditbeat", "name": "auditbeat", "pid": 19950, "ppid": 9118, "seccomp": {"mode":"disabled"}, "start\_time": "2018-07-04T18:01:32.100Z"}}} 2018-07-04T18:01:32.405Z INFO instance/beat.go:225 Setup Beat: auditbeat; Version: 6.3.0 2018-07-04T18:01:32.405Z DEBUG [beat] instance/beat.go:242 Initializing output plugins 2018-07-04T18:01:32.406Z DEBUG [processors] processors/processor.go:49 Processors: 2018-07-04T18:01:32.408Z DEBUG [publish] pipeline/consumer.go:120 start pipeline event consumer 2018-07-04T18:01:32.408Z INFO pipeline/module.go:81 Beat name: xxxx-xxxx 2018-07-04T18:01:32.408Z DEBUG [modules] beater/metricbeat.go:81 Register [ModuleFactory:[], MetricSetFactory:[auditd/auditd, file\_integrity/file]] 2018-07-04T18:01:32.408Z DEBUG [processors] processors/processor.go:49 Processors: 2018-07-04T18:01:32.409Z INFO [auditd] auditd/audit\_linux.go:65 auditd module is running as euid=0 on kernel=3.16.39+pam02 2018-07-04T18:01:32.409Z DEBUG [processors] processors/processor.go:49 Processors: 2018-07-04T18:01:32.410Z DEBUG [file\_integrity] file\_integrity/metricset.go:86 Initialized the file event reader. Running as euid=0 2018-07-04T18:01:32.410Z INFO instance/beat.go:275 auditbeat stopped. 2018-07-04T18:01:32.410Z ERROR instance/beat.go:691 Exiting: 1 error: 1 error: failed to create audit client: failed to create audit client: protocol not supported Exiting: 1 error: 1 error: failed to create audit client: failed to create audit client: protocol not supported ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [July 6, 2018, 8:21am UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-protocol-not-supported/138601/2 "2018-07-06T08:21:48Z")
This error means your kernel has been compiled without audit support. I understand it's a custom kernel? It needs: > CONFIG\_AUDIT=y ---
**Author:** ![Nicholas\_Amon](https://avatars.discourse-cdn.com/v4/letter/n/a183cd/32.png) [@Nicholas\_Amon](https://discuss.elastic.co/u/Nicholas_Amon)\ **Post date:** [July 7, 2018, 2:48pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-protocol-not-supported/138601/3 "2018-07-07T14:48:13Z")
Ah, thanks! ---
**Author:** ![Simone\_Scarduzio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone_scarduzio/32/17128_2.png) [@Simone\_Scarduzio](https://discuss.elastic.co/u/Simone_Scarduzio)\ **Post date:** [June 27, 2020, 1:15pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-protocol-not-supported/138601/4 "2020-06-27T13:15:31Z")
This issue affects Microsoft Windows subsystem for Linux (WSL). Auditbeat just won't start up. Any workaround? Just want Auditbeat to send ANY events for testing tbh. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [June 29, 2020, 2:48pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-protocol-not-supported/138601/5 "2020-06-29T14:48:12Z")
@Simone_Scarduzio disable the `auditd` module: ```auto - module: auditd enabled: false ``` in auditbeat.yml ---
**Author:** ![Simone\_Scarduzio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone_scarduzio/32/17128_2.png) [@Simone\_Scarduzio](https://discuss.elastic.co/u/Simone_Scarduzio)\ **Post date:** [June 29, 2020, 9:21pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-protocol-not-supported/138601/6 "2020-06-29T21:21:13Z")
> [@adrisr](#): > > ```auto > - module: auditd > enabled: false > > ``` thanks @adrisr it worked 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 5:27am UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-protocol-not-supported/138601/7 "2022-11-04T05:27:59Z")