# Auditbeat getsockopt: connection refused

**URL:** <https://discuss.elastic.co/t/auditbeat-getsockopt-connection-refused/183118>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [May 28, 2019, 1:56pm UTC](https://discuss.elastic.co/t/auditbeat-getsockopt-connection-refused/183118 "2019-05-28T13:56:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Richard\_Phillips\_Roy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richard_phillips_roy/32/46989_2.png) [@Richard\_Phillips\_Roy](https://discuss.elastic.co/u/Richard_Phillips_Roy)\
**Post date:** [May 28, 2019, 1:56pm UTC](https://discuss.elastic.co/t/auditbeat-getsockopt-connection-refused/183118/1 "2019-05-28T13:56:23Z")

</div>

I'm running elasticsearch and kibana on the host machine and i want to send the auditbeat data from ubuntu running on virtual box to the host machine please help me with it.

---

<div class="post-metadata">

**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\
**Post date:** [May 28, 2019, 8:49pm UTC](https://discuss.elastic.co/t/auditbeat-getsockopt-connection-refused/183118/2 "2019-05-28T20:49:06Z")

</div>

@Richard_Phillips_Roy Can you describe how you have set up the systems (esp. network) and post the Auditbeat log incl. the `getsockopt` error message? Maybe also run Auditbeat with debug logging enabled (append `-e -d "*"` when running it).

Btw, what I do in this scenario is log in from the host machine to the virtual one using `ssh` and port forwarding with `-R 9200:localhost:9200`. That will make it look to Auditbeat in the virtual machine as if Elasticsearch is running inside the virtual machine.

---

<div class="post-metadata">

**Author:** ![Richard\_Phillips\_Roy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richard_phillips_roy/32/46989_2.png) [@Richard\_Phillips\_Roy](https://discuss.elastic.co/u/Richard_Phillips_Roy)\
**Post date:** [June 4, 2019, 1:33am UTC](https://discuss.elastic.co/t/auditbeat-getsockopt-connection-refused/183118/3 "2019-06-04T01:33:45Z")

</div>

How do i enable auditd module inside auditbeat 7.1 ?  
Here is my configuration  
[https://pastebin.com/0Trg6rmm](https://pastebin.com/0Trg6rmm)  
I'm getting this error when i tried to setup kibana dashboards  
Exiting: 1 error: 1 error: metricset 'auditd/kernel' is not registered, module not found

---

<div class="post-metadata">

**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\
**Post date:** [June 4, 2019, 4:46pm UTC](https://discuss.elastic.co/t/auditbeat-getsockopt-connection-refused/183118/4 "2019-06-04T16:46:28Z")

</div>

Ah, I see. With Auditbeat 6.2, we unbundled the `kernel` and `file` metricsets into their own modules: `auditd` and `file_integrity`. So there are no more metricsets.

You can see the current configuration reference file [here](https://www.elastic.co/guide/en/beats/auditbeat/7.1/auditbeat-reference-yml.html) (also ships with Auditbeat).

So what you would do is change to:

```auto
- module: auditd
  audit_rules: |
    <your rules go here>

- module: file_integrity
  paths:
    <your paths go here>

```

---

<div class="post-metadata">

**Author:** ![Richard\_Phillips\_Roy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richard_phillips_roy/32/46989_2.png) [@Richard\_Phillips\_Roy](https://discuss.elastic.co/u/Richard_Phillips_Roy)\
**Post date:** [June 5, 2019, 2:56am UTC](https://discuss.elastic.co/t/auditbeat-getsockopt-connection-refused/183118/5 "2019-06-05T02:56:37Z")

</div>

Okay Thank you  
How do i start auditd service ?  
i created a rules.conf file in audit.rules.d folder and wrote some rules and i changed the auditbeat.yml to point at the rules file audit\_rule\_files: ['$/etc/auditbeat/audit.rules.d/rules.conf']  
and when i run sudo auditbeat show auditd-rules  
No rules

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2019, 2:56am UTC](https://discuss.elastic.co/t/auditbeat-getsockopt-connection-refused/183118/6 "2019-06-26T02:56:45Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.