Auditbeat, Filebeat error: system/socket dataset setup failed: unable to monitor probe p:inet6_create inet6_create proto={{.P3}}:s32: perf_event_open: too many open files

[bilal_abudan]

Can someone help me please ... ???

i am using Filebeat and Auditbeat,

Lets have Auditbeat one,
This issue when i started the auditbeat service and theres error below :

Exiting: 1 error: system/socket dataset setup failed: unable to monitor probe p:inet6_create inet6_create proto={{.P3}}:s32: perf_event_open: too many open files

what i have already did is :
1. increase limit 
ulimit -n 65536

2. adding socket.enable_ipv6: false in auditbeat.yml
- module: system
  socket.enable_ipv6: false

and still happening those error, need help to fixing this .
Thanks

[Wolfram_Haussig]

Hi,

Maybe you are running into the same problem as described here?

What happens if you try to start AuditBeat manually instead of using the service?

Best regards
Wolfram

[bilal_abudan]

Its working fine if i start the service in foreground
auditbeat run -e -d '*'

but error happening when i trying to start the service in background
service start auditbeat

so how can there's the difference between both?

[Wolfram_Haussig]

I am no linux expert so I can only refer you to the solution described in the issue above:

It turns out, that (at least on Debian 8) systemd applies some default ulimits to processes started as it's units. In particular, it applies this 1024 file limit. To increase the limit I had to create /etc/systemd/system/filebeat.service.d/override.conf with

[Service]
LimitNOFILE=65536