# Auditbeat not work in Ubuntu 22.04 after a reboot or shutdown **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [October 30, 2024, 7:20am UTC](https://discuss.elastic.co/t/auditbeat-not-work-in-ubuntu-22-04-after-a-reboot-or-shutdown/369785 "2024-10-30T07:20:34Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![L1ghtsou1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/l1ghtsou1/32/138849_2.png) [@L1ghtsou1](https://discuss.elastic.co/u/L1ghtsou1)\ **Post date:** [October 30, 2024, 7:20am UTC](https://discuss.elastic.co/t/auditbeat-not-work-in-ubuntu-22-04-after-a-reboot-or-shutdown/369785/1 "2024-10-30T07:20:34Z")
I installed Elasticsearch and Auditbeat service version 8.15.2 for Ubuntu Server 22.04. After host reboot, auditbeat inactive and not send log to ELK node. ```auto service auditbeat status ○ auditbeat.service - Audit the activities of users and processes on your system. Loaded: loaded (/lib/systemd/system/auditbeat.service; disabled; vendor pre> Active: inactive (dead) Docs: https://www.elastic.co/beats/auditbeat ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 30, 2024, 12:59pm UTC](https://discuss.elastic.co/t/auditbeat-not-work-in-ubuntu-22-04-after-a-reboot-or-shutdown/369785/2 "2024-10-30T12:59:40Z")
Hello and welcome? Did you restart the service? What error did you get when you restart it? The service is listed as `disabled` so it will not restart on reboots, you need to manually start it or enable it. `systemctl start auditbeat` to start it and `systemctl enable auditbeat` to enable it. ---
**Author:** ![L1ghtsou1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/l1ghtsou1/32/138849_2.png) [@L1ghtsou1](https://discuss.elastic.co/u/L1ghtsou1)\ **Post date:** [October 31, 2024, 1:42am UTC](https://discuss.elastic.co/t/auditbeat-not-work-in-ubuntu-22-04-after-a-reboot-or-shutdown/369785/3 "2024-10-31T01:42:45Z")
Error is auditbeat not working and it not send log to elastic. I wanna restart auditbeat automationly, auditbeat can do it?? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 31, 2024, 3:34am UTC](https://discuss.elastic.co/t/auditbeat-not-work-in-ubuntu-22-04-after-a-reboot-or-shutdown/369785/4 "2024-10-31T03:34:59Z")
> [@L1ghtsou1](#): > > Error is auditbeat not working and it not send log to elastic. You didn't say if you restart it or not. Did you run `systemctl start auditbeat`? Did it work? Did it give you any error? The service is **disabled** , so it will not restart after a reboot, you need to enable it with the commands shared in the previous post. To start it use `systemctl start auditbeat`. To enable it so it will restart after a reboot use `systemctl enable auditbeat`. Also, this seems unrelated to auditbeat, it seems just a systemd misconfiguration. Edit: corrected the enable command. ---
**Author:** ![L1ghtsou1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/l1ghtsou1/32/138849_2.png) [@L1ghtsou1](https://discuss.elastic.co/u/L1ghtsou1)\ **Post date:** [October 31, 2024, 7:17am UTC](https://discuss.elastic.co/t/auditbeat-not-work-in-ubuntu-22-04-after-a-reboot-or-shutdown/369785/5 "2024-10-31T07:17:22Z")
Yeah, i forget it. Auditbeat actived, then i reboot host and auditbeat inactive. Auditbeat not work normally, miss log for mornitoring system until i restart it manually. This is so inconvenient because i have many hosts. So i should have a shell executing active Auditbeat whenever host reboot/ shutdown or configure of auditbeat can perform it to i not start it manually? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 31, 2024, 12:50pm UTC](https://discuss.elastic.co/t/auditbeat-not-work-in-ubuntu-22-04-after-a-reboot-or-shutdown/369785/6 "2024-10-31T12:50:23Z")
> [@L1ghtsou1](#): > > So i should have a shell executing active Auditbeat whenever host reboot/ shutdown or configure of auditbeat can perform it to i not start it manually? If you run **systemctl enable auditbeat** it should start when the host is rebooted. ---
**Author:** ![L1ghtsou1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/l1ghtsou1/32/138849_2.png) [@L1ghtsou1](https://discuss.elastic.co/u/L1ghtsou1)\ **Post date:** [November 1, 2024, 2:05am UTC](https://discuss.elastic.co/t/auditbeat-not-work-in-ubuntu-22-04-after-a-reboot-or-shutdown/369785/7 "2024-11-01T02:05:23Z")
Probleam was solved. I'm really grateful for your help