# Auditbeat fatal error (crash)

**URL:** <https://discuss.elastic.co/t/auditbeat-fatal-error-crash/143300>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [August 7, 2018, 10:08am UTC](https://discuss.elastic.co/t/auditbeat-fatal-error-crash/143300 "2018-08-07T10:08:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ppanagiotis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppanagiotis/32/34069_2.png) [@ppanagiotis](https://discuss.elastic.co/u/ppanagiotis)\
**Post date:** [August 7, 2018, 10:08am UTC](https://discuss.elastic.co/t/auditbeat-fatal-error-crash/143300/1 "2018-08-07T10:08:59Z")

</div>

auditbeat occasionally crashes with the following error:

> [Aug 07 12:32:14 hostname auditbeat[10686]: fatal error: concurrent map writesA - Pastebin.com](https://pastebin.com/h6ibjEjd)

The package is build with master branch (head commit b84e083625ec10)  
OS: SMP Debian 4.9.88-1+deb9u1  
Kernel: 4.9.0-6-amd64

---

<div class="post-metadata">

**Author:** ![ppanagiotis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppanagiotis/32/34069_2.png) [@ppanagiotis](https://discuss.elastic.co/u/ppanagiotis)\
**Post date:** [August 7, 2018, 10:55am UTC](https://discuss.elastic.co/t/auditbeat-fatal-error-crash/143300/2 "2018-08-07T10:55:29Z")

</div>

As I can see commit 124c8a28f9 introduce the problem with that:

```auto
        for i := 0; i < numConsumers; i++ {
                go func() {
                        defer wg.Done()
                        for {
                                select {
                                case <-reporter.Done():
                                        return
                                case msgs := <-out:
                                        reporter.Event(buildMetricbeatEvent(msgs, ms.config))
                                }   
                        }   
                }() 
        }

```

numConsumers is equal with the number of the cpus (max = 4)

which is unsafe.  
( if I set up max\_procs: 1 at auditbeat.yml the problem goes away )

cc @adrisr

---

<div class="post-metadata">

**Author:** ![ppanagiotis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppanagiotis/32/34069_2.png) [@ppanagiotis](https://discuss.elastic.co/u/ppanagiotis)\
**Post date:** [August 7, 2018, 3:14pm UTC](https://discuss.elastic.co/t/auditbeat-fatal-error-crash/143300/3 "2018-08-07T15:14:12Z")

</div>

As I can see It is fixed at go-libaudit

> <https://github.com/elastic/go-libaudit/blob/master/aucoalesce/id_lookup.go#L48>

I make a pull request [https://github.com/elastic/beats/pull/7898](https://github.com/elastic/beats/pull/7898)

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [August 7, 2018, 4:00pm UTC](https://discuss.elastic.co/t/auditbeat-fatal-error-crash/143300/4 "2018-08-07T16:00:52Z")

</div>

Thanks! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 5:31am UTC](https://discuss.elastic.co/t/auditbeat-fatal-error-crash/143300/5 "2022-11-04T05:31:36Z")

</div>