# Auditbeat not starting on Startup - Mac

**URL:** <https://discuss.elastic.co/t/auditbeat-not-starting-on-startup-mac/218802>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [February 11, 2020, 3:37pm UTC](https://discuss.elastic.co/t/auditbeat-not-starting-on-startup-mac/218802 "2020-02-11T15:37:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bill.S.Preston](https://avatars.discourse-cdn.com/v4/letter/b/c5a1d2/32.png) [@Bill.S.Preston](https://discuss.elastic.co/u/Bill.S.Preston)\
**Post date:** [February 11, 2020, 3:37pm UTC](https://discuss.elastic.co/t/auditbeat-not-starting-on-startup-mac/218802/1 "2020-02-11T15:37:22Z")

</div>

I can't seem to get my auditbeat to start sending data to my ElastaCloud from my Mac. Every time I start it I need to execute the following commands and it won't log until that point

./auditbeat setup  
./auditbeat -e

Any idea what I need to do to get this running from Start up?

---

<div class="post-metadata">

**Author:** ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)\
**Post date:** [February 11, 2020, 4:06pm UTC](https://discuss.elastic.co/t/auditbeat-not-starting-on-startup-mac/218802/2 "2020-02-11T16:06:50Z")

</div>

Hello, when you installed auditbeat, did you use download the tar file for macOS or use brew?

[https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-installation.html](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-installation.html)

If you use the version available in brew, it integrates with launchd to start the service.

[https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-starting.html](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-starting.html)

---

<div class="post-metadata">

**Author:** ![Bill.S.Preston](https://avatars.discourse-cdn.com/v4/letter/b/c5a1d2/32.png) [@Bill.S.Preston](https://discuss.elastic.co/u/Bill.S.Preston)\
**Post date:** [February 11, 2020, 4:21pm UTC](https://discuss.elastic.co/t/auditbeat-not-starting-on-startup-mac/218802/3 "2020-02-11T16:21:45Z")

</div>

Hi Michael,

I downloaded the tar file for macOS using the following commands from the Auditbeat setup on Elastacloud

curl -L -O [https://artifacts.elastic.co/downloads/beats/auditbeat/auditbeat-7.5.2-darwin-x86\_64.tar.gz](https://artifacts.elastic.co/downloads/beats/auditbeat/auditbeat-7.5.2-darwin-x86_64.tar.gz)  
tar xzvf auditbeat-7.5.2-darwin-x86\_64.tar.gz

I don't have brew on my Mac. I'm running this as a poc at the moment so reluctant to go down that route if I can avoid it

---

<div class="post-metadata">

**Author:** ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)\
**Post date:** [February 11, 2020, 5:51pm UTC](https://discuss.elastic.co/t/auditbeat-not-starting-on-startup-mac/218802/4 "2020-02-11T17:51:58Z")

</div>

Hi Bill,

The tarball for auditbeat on macOS does not include the plist file needed for launchd. There's a older thread that outlines setting up filebeat on macOS. The manual process should be pretty similar for auditbeat.

> [@Deploying Filebeat on MacOS X](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785):
>
> Hi all, I am looking into deploying filebeat on Mac OS X (10.11). The package does not contain the wrapper binary filebeat-god, so the question is how to daemonize filebeat properly. Starting it manually I can use "./filebeat -e -c filebeat.yml &" to dispatch ist from my shell, but for handing it over to launchd that would be poor. Anyone out there already using it on MacOS X? Any hint or help is appreciated. Dirk

Additionally, you could review the brew forumla for auditbeat to find which steps are needed to manually create the needed plist file for auditbeat.

> <https://github.com/elastic/homebrew-tap/blob/master/Formula/auditbeat-full.rb>

Please let us know if you have additional questions.

---

<div class="post-metadata">

**Author:** ![Bill.S.Preston](https://avatars.discourse-cdn.com/v4/letter/b/c5a1d2/32.png) [@Bill.S.Preston](https://discuss.elastic.co/u/Bill.S.Preston)\
**Post date:** [February 12, 2020, 8:34am UTC](https://discuss.elastic.co/t/auditbeat-not-starting-on-startup-mac/218802/5 "2020-02-12T08:34:52Z")

</div>

Thanks Michael. I will review the thread and the brew formula and see if I can figure out how to get this working.

Thanks for your assistance and the clarity on Auditbeat for Mac

---

<div class="post-metadata">

**Author:** ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)\
**Post date:** [February 16, 2020, 2:39am UTC](https://discuss.elastic.co/t/auditbeat-not-starting-on-startup-mac/218802/6 "2020-02-16T02:39:59Z")

</div>

Hello,

You're welcome. Please let us know if you hit any issues with the auditbeat setup for macOS.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2020, 2:40am UTC](https://discuss.elastic.co/t/auditbeat-not-starting-on-startup-mac/218802/7 "2020-03-08T02:40:04Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.
