# Auditbeat, Filebeat error: system/socket dataset setup failed: unable to monitor probe p:inet6\_create inet6\_create proto={{.P3}}:s32: perf\_event\_open: too many open files

**URL:** <https://discuss.elastic.co/t/auditbeat-filebeat-error-system-socket-dataset-setup-failed-unable-to-monitor-probe-p-inet6-create-inet6-create-proto-p3-perf-event-open-too-many-open-files/251210>\
**Category:** Beats\
**Tags:** filebeat, auditbeat\
**Created:** [October 7, 2020, 4:59am UTC](https://discuss.elastic.co/t/auditbeat-filebeat-error-system-socket-dataset-setup-failed-unable-to-monitor-probe-p-inet6-create-inet6-create-proto-p3-perf-event-open-too-many-open-files/251210 "2020-10-07T04:59:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bilal\_abudan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bilal_abudan/32/76709_2.png) [@bilal\_abudan](https://discuss.elastic.co/u/bilal_abudan)\
**Post date:** [October 7, 2020, 4:59am UTC](https://discuss.elastic.co/t/auditbeat-filebeat-error-system-socket-dataset-setup-failed-unable-to-monitor-probe-p-inet6-create-inet6-create-proto-p3-perf-event-open-too-many-open-files/251210/1 "2020-10-07T04:59:19Z")

</div>

Can someone help me please ... ???

i am using Filebeat and Auditbeat,

Lets have Auditbeat one,  
This issue when i started the auditbeat service and theres error below :

```auto
Exiting: 1 error: system/socket dataset setup failed: unable to monitor probe p:inet6_create inet6_create proto={{.P3}}:s32: perf_event_open: too many open files

```

```auto
what i have already did is :
1. increase limit 
ulimit -n 65536

2. adding socket.enable_ipv6: false in auditbeat.yml
- module: system
  socket.enable_ipv6: false

```

and still happening those error, need help to fixing this .  
Thanks

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [October 7, 2020, 6:42am UTC](https://discuss.elastic.co/t/auditbeat-filebeat-error-system-socket-dataset-setup-failed-unable-to-monitor-probe-p-inet6-create-inet6-create-proto-p3-perf-event-open-too-many-open-files/251210/2 "2020-10-07T06:42:19Z")

</div>

Hi,

Maybe you are running into the same problem as described [here](https://github.com/elastic/beats/issues/12069)?

What happens if you try to start AuditBeat manually instead of using the service?

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![bilal\_abudan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bilal_abudan/32/76709_2.png) [@bilal\_abudan](https://discuss.elastic.co/u/bilal_abudan)\
**Post date:** [October 8, 2020, 3:13am UTC](https://discuss.elastic.co/t/auditbeat-filebeat-error-system-socket-dataset-setup-failed-unable-to-monitor-probe-p-inet6-create-inet6-create-proto-p3-perf-event-open-too-many-open-files/251210/3 "2020-10-08T03:13:30Z")

</div>

Its working fine if i start the service in foreground  
`auditbeat run -e -d '*'`

but error happening when i trying to start the service in background  
`service start auditbeat`

so how can there's the difference between both?

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [October 8, 2020, 4:44am UTC](https://discuss.elastic.co/t/auditbeat-filebeat-error-system-socket-dataset-setup-failed-unable-to-monitor-probe-p-inet6-create-inet6-create-proto-p3-perf-event-open-too-many-open-files/251210/4 "2020-10-08T04:44:13Z")

</div>

I am no linux expert so I can only refer you to the solution described in the issue above:

> It turns out, that (at least on Debian 8) systemd applies some default ulimits to processes started as it's units. In particular, it applies this 1024 file limit. To increase the limit I had to create `/etc/systemd/system/filebeat.service.d/override.conf` with

```auto
[Service]
LimitNOFILE=65536

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2020, 6:44am UTC](https://discuss.elastic.co/t/auditbeat-filebeat-error-system-socket-dataset-setup-failed-unable-to-monitor-probe-p-inet6-create-inet6-create-proto-p3-perf-event-open-too-many-open-files/251210/5 "2020-11-05T06:44:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.