# Auditbeat not displayiing parameters

**URL:** <https://discuss.elastic.co/t/auditbeat-not-displayiing-parameters/133748>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [May 29, 2018, 7:59pm UTC](https://discuss.elastic.co/t/auditbeat-not-displayiing-parameters/133748 "2018-05-29T19:59:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![data\_smith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/data_smith/32/124122_2.png) [@data\_smith](https://discuss.elastic.co/u/data_smith)\
**Post date:** [May 29, 2018, 7:59pm UTC](https://discuss.elastic.co/t/auditbeat-not-displayiing-parameters/133748/1 "2018-05-29T19:59:48Z")

</div>

I've setup Auditbeat to report on Docker activity but I don't see the parameters. For example if a user types docker exec auditbeat env, the resulting Auditbeat record just has { "auditd" : { "data": { "op": "exec"... but there's no parameters. What did they execute? I don't know because I don't see any parameters in the audit record.

Is this normal? Do I need to change a configuration to see the parameters?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 29, 2018, 8:15pm UTC](https://discuss.elastic.co/t/auditbeat-not-displayiing-parameters/133748/2 "2018-05-29T20:15:32Z")

</div>

> [@data\_smith](#):
>
> I've setup Auditbeat to report on Docker activity

How did you do this? Please show the configuration that you are using, OS version, and the Auditbeat version.

Are you monitoring `execve` syscalls? I would use something like:

```auto
auditbeat.modules:
- module: auditd
  audit_rules: |
    -a always,exit -F arch=b64 -S execve,execveat -k exec
  processors:
    - add_docker_metadata: ~
```

---

<div class="post-metadata">

**Author:** ![data\_smith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/data_smith/32/124122_2.png) [@data\_smith](https://discuss.elastic.co/u/data_smith)\
**Post date:** [May 29, 2018, 8:52pm UTC](https://discuss.elastic.co/t/auditbeat-not-displayiing-parameters/133748/3 "2018-05-29T20:52:04Z")

</div>

Container: Centos 7.4 - Linux 3.10  
OS Host: Centos 7.2 - Linux 3.10  
Auditbeat 6.2.4  
Configuration below:

auditbeat.modules:

- module: auditd  
audit\_rules: |  
-w /usr/bin/docker -p rwxa -k docker

I'm not monitoring execve syscalls. I'll try that. I'm trying to avoid a lot of noise.

---

<div class="post-metadata">

**Author:** ![data\_smith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/data_smith/32/124122_2.png) [@data\_smith](https://discuss.elastic.co/u/data_smith)\
**Post date:** [May 29, 2018, 8:55pm UTC](https://discuss.elastic.co/t/auditbeat-not-displayiing-parameters/133748/4 "2018-05-29T20:55:02Z")

</div>

I added those rules and it looks a lot better. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 5:24am UTC](https://discuss.elastic.co/t/auditbeat-not-displayiing-parameters/133748/5 "2022-11-04T05:24:25Z")

</div>