# Auditbeat only sending metrics, not events

**URL:** <https://discuss.elastic.co/t/auditbeat-only-sending-metrics-not-events/215121>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [January 15, 2020, 11:02am UTC](https://discuss.elastic.co/t/auditbeat-only-sending-metrics-not-events/215121 "2020-01-15T11:02:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![blastic](https://avatars.discourse-cdn.com/v4/letter/b/ad7895/32.png) [@blastic](https://discuss.elastic.co/u/blastic)\
**Post date:** [January 15, 2020, 11:02am UTC](https://discuss.elastic.co/t/auditbeat-only-sending-metrics-not-events/215121/1 "2020-01-15T11:02:41Z")

</div>

Hello.

I'm having the following problems: I'm having machines with Debian 9.11 that run auditd (for managing the audit-rules) and auditbeat (version 7.5.1, for shipping the events off to logstash).

Even though the configuration for auditbeat is working and I see metrics sent to logstash (both in the journal of auditbeat as well as in logstash), I don't see any audit-events being processed.

My auditbeat.yml is this:

> ```
> ---
> 
> ```
> 
> name: web01  
> fields\_under\_root: false  
> queue:  
> mem:  
> events: 4096  
> flush:  
> min\_events: 0  
> timeout: 0s  
> logging:  
> level: info  
> selectors: :undef  
> to\_syslog: false  
> to\_eventlog: false  
> json: false  
> to\_files: true  
> files:  
> path: "/var/log/auditbeat"  
> name: auditbeat  
> keepfiles: 7  
> rotateeverybytes: 10485760  
> permissions: '0600'  
> metrics:  
> enabled: true  
> period: 30s  
> output:  
> logstash:  
> hosts:  
> - log01:5000  
> - log02:5000  
> - log03:5000  
> ssl:  
> enabled: true  
> certificate\_authorities:  
> - "/etc/ssl/certs/validcert.pem"  
> auditbeat:  
> modules:
> 
> - module: auditd  
> enabled: true

The only interesting message I see in the logs is:  
[auditd] auditd/audit\_linux.go:216 No audit\_rules were specified.

Which is correct, I did not specify any rules. But auditbeat seems to acknowledge that there are rules present, according to _auditbeat show auditd-rules_. Could anyone provide some leads on how to solve this? Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2020, 11:11am UTC](https://discuss.elastic.co/t/auditbeat-only-sending-metrics-not-events/215121/2 "2020-02-05T11:11:49Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.