# Auditbeat logs write to /var/log/messages **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [September 14, 2022, 4:03am UTC](https://discuss.elastic.co/t/auditbeat-logs-write-to-var-log-messages/314361 "2022-09-14T04:03:45Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![masonlu2014](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/masonlu2014/32/110835_2.png) [@masonlu2014](https://discuss.elastic.co/u/masonlu2014)\ **Post date:** [September 14, 2022, 4:03am UTC](https://discuss.elastic.co/t/auditbeat-logs-write-to-var-log-messages/314361/1 "2022-09-14T04:03:45Z")
hi guys, we are sawing weird issue, we are using auditbeat as pod running on our kubenets cluster, however in some day, we saw there is a large audit events has been write to our work node /var/log/message, and i can confirm auditd service has been disable on the work node. so anything reason happen on this ? thanks for help ---
**Author:** ![masonlu2014](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/masonlu2014/32/110835_2.png) [@masonlu2014](https://discuss.elastic.co/u/masonlu2014)\ **Post date:** [September 14, 2022, 4:20am UTC](https://discuss.elastic.co/t/auditbeat-logs-write-to-var-log-messages/314361/2 "2022-09-14T04:20:00Z")
a lot auditd events write in /var/log/messages in short time ```auto Sep 7 18:16:52 node-v88jz-11 audit: PROCTITLE proctitle=2F6E657464002D2D64697361626C652D746573736E65742D66696E616C697A65723D74727565002D2D636F6E6669673D2F6D6E742F6970616D2D636F6E6669672F636F6E6669672E6A736F6E002D2D656E61626C652D746C626D656D6265722D636F6E74726F6C6C65723D74727565002D2D746C626D656D6265722D776F726B Sep 7 18:16:52 node-v88jz-11 audit[57547]: SYSCALL arch=c000003e syscall=281 success=yes exit=0 a0=3 a1=c001049800 a2=80 a3=0 items=0 ppid=57169 pid=57547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="admission-serve" exe="/admission-server" subj=? key=(null) Sep 7 18:16:52 node-v88jz-11 audit[57547]: SYSCALL arch=c000003e syscall=281 success=yes exit=0 a0=3 a1=c001049800 a2=80 a3=0 items=0 ppid=57169 pid=57547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="admission-serve" exe="/admission-server" subj=? key=(null) Sep 7 18:16:52 node-v88jz-11 audit[57923]: SYSCALL arch=c000003e syscall=202 success=yes exit=0 a0=c0047e2148 a1=80 a2=0 a3=0 items=0 ppid=60774 pid=57923 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netd" exe="/netd" subj=? key=(null) Sep 7 18:16:52 node-v88jz-11 audit[57923]: SYSCALL arch=c000003e syscall=202 success=yes exit=0 a0=c0047e2148 a1=80 a2=0 a3=0 items=0 ppid=60774 pid=57923 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netd" exe="/netd" subj=? key=(null) Sep 7 18:16:52 node-v88jz-11 audit: PROCTITLE proctitle=2F61646D697373696F6E2D736572766572002D2D61757468656E7469636174696F6E2D6B756265636F6E6669673D2F6574632F6170697365727665722F6167672D6B756265636F6E666967002D2D61757468656E7469636174696F6E2D736B69702D6C6F6F6B75703D74727565002D2D617574686F72697A6174696F6E2D6B75 ``` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 15, 2022, 1:13pm UTC](https://discuss.elastic.co/t/auditbeat-logs-write-to-var-log-messages/314361/3 "2022-09-15T13:13:42Z")
I can think of a two things to check. 1. journald can receive audit events over multicast and log them. You can disable it with `systemctl mask systemd-journald-audit.socket`. 2. The kernel has a feature to optionally write messages using `printk`. You can control this with Auditbeat by adding `failure_mode: silent` (see [docs](https://www.elastic.co/guide/en/beats/auditbeat/master/auditbeat-module-auditd.html#_configuration_options_15)). You can check the value with `auditctl -s` (from auditd) or `auditbeat show auditd-status`. ---
**Author:** ![masonlu2014](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/masonlu2014/32/110835_2.png) [@masonlu2014](https://discuss.elastic.co/u/masonlu2014)\ **Post date:** [September 16, 2022, 12:32pm UTC](https://discuss.elastic.co/t/auditbeat-logs-write-to-var-log-messages/314361/4 "2022-09-16T12:32:09Z")
thanks andrewkroh, let me try that ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 14, 2022, 2:32pm UTC](https://discuss.elastic.co/t/auditbeat-logs-write-to-var-log-messages/314361/5 "2022-10-14T14:32:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.