# Auditbeat is devouring the CPU

**URL:** <https://discuss.elastic.co/t/auditbeat-is-devouring-the-cpu/195815>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [August 19, 2019, 10:15pm UTC](https://discuss.elastic.co/t/auditbeat-is-devouring-the-cpu/195815 "2019-08-19T22:15:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![craig.merchant](https://avatars.discourse-cdn.com/v4/letter/c/ea666f/32.png) [@craig.merchant](https://discuss.elastic.co/u/craig.merchant)\
**Post date:** [August 19, 2019, 10:15pm UTC](https://discuss.elastic.co/t/auditbeat-is-devouring-the-cpu/195815/1 "2019-08-19T22:15:22Z")

</div>

I have installed auditbeat on an Ubuntu Linux 18.04 VM. I am using the recommended audit.rules config from the CIS benchmarks.

When auditbeat is running, it consistently consumes 40-60% of a core. The native Linux audit daemon runs at less than 1%.

I'm new to auditbeat. How do I go about troubleshooting performance issues like this?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 19, 2019, 11:25pm UTC](https://discuss.elastic.co/t/auditbeat-is-devouring-the-cpu/195815/2 "2019-08-19T23:25:20Z")

</div>

I would advise to turn off rules that audits network activity. It's very expensive. We're working on a better way to monitor network activity for Auditbeat that does not utilize the audit framework.

> <https://github.com/elastic/beats/blob/v7.3.0/auditbeat/module/auditd/_meta/audit.rules.d/sample-rules-linux-64bit.conf#L10-L11>

---

<div class="post-metadata">

**Author:** ![craig.merchant](https://avatars.discourse-cdn.com/v4/letter/c/ea666f/32.png) [@craig.merchant](https://discuss.elastic.co/u/craig.merchant)\
**Post date:** [August 20, 2019, 6:31pm UTC](https://discuss.elastic.co/t/auditbeat-is-devouring-the-cpu/195815/3 "2019-08-20T18:31:25Z")

</div>

@andrewkroh... auditing network connections like the rule you described isn't part of the CIS benchmarks. But even if it was, it wouldn't explain why auditbeat takes 50x more CPU than auditd using the same ruleset.

How do I troubleshoot performance issues with auditbeat?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 10, 2019, 6:31pm UTC](https://discuss.elastic.co/t/auditbeat-is-devouring-the-cpu/195815/4 "2019-09-10T18:31:30Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.