# Auditbeat permission Error

**URL:** <https://discuss.elastic.co/t/auditbeat-permission-error/213318>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [December 30, 2019, 8:02am UTC](https://discuss.elastic.co/t/auditbeat-permission-error/213318 "2019-12-30T08:02:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![irobot678](https://avatars.discourse-cdn.com/v4/letter/i/54ee81/32.png) [@irobot678](https://discuss.elastic.co/u/irobot678)\
**Post date:** [December 30, 2019, 8:02am UTC](https://discuss.elastic.co/t/auditbeat-permission-error/213318/1 "2019-12-30T08:02:21Z")

</div>

Hi, i'm using elk stack 7.1.1 with x-pack installed and i'm trying to setup auditbeat but i am getting the following error:

```
2019-12-30T13:18:04.176+0530	ERROR	instance/beat.go:802	Exiting: 1 error: 1 error: failed to create audit client: failed to get audit status: operation not permitted
Exiting: 1 error: 1 error: failed to create audit client: failed to get audit status: operation not permitted

```

auditbeat.yml conf

```
auditbeat.modules:

- module: auditd
  # Load audit rules from separate files. Same format as audit.rules(7).
  audit_rule_files: ['${path.config}/audit.rules.d/*.conf']
  audit_rules: |

- module: file_integrity
  paths:
  - /bin
  - /usr/bin
  - /sbin
  - /usr/sbin
  - /etc

- module: system
  datasets:
    - host
    - login
    - package
    - process
    - socket
    - user

  state.period: 12h
  user.detect_password_changes: true
  login.wtmp_file_pattern: /var/log/wtmp*
  login.btmp_file_pattern: /var/log/btmp*

 setup.template.settings:
      index.number_of_shards: 1
      index.codec: best_compression

 setup.kibana:
     host: "localhost:5601"

  output.elasticsearch: 
      hosts: ["localhost:9200"]
      index: "auditbeat-7.1.1-%{+yyyy.MM.dd}"
      protocol: "https"
      username: "elastic"
      password: "mypassword"
 setup.template:
     name: 'auditbeat'
     pattern: 'auditbeat-*'
     enabled: false

```

Please help me solve it.

---

<div class="post-metadata">

**Author:** ![Dain.Perkins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dain.perkins/32/41143_2.png) [@Dain.Perkins](https://discuss.elastic.co/u/Dain.Perkins)\
**Post date:** [December 31, 2019, 4:28pm UTC](https://discuss.elastic.co/t/auditbeat-permission-error/213318/2 "2019-12-31T16:28:00Z")

</div>

Hi Vamsi,

I believe the user account has insufficient privileges. Try "sudo " on linux/macos or "run as administrator" (on windows)

Here's a link to some info on running auditbeat as a non-root user as well (linux specific I believe)

> [@Run Auditbeat with non-root user](https://discuss.elastic.co/t/run-auditbeat-with-non-root-user/193707):
>
> Hi Elastic Team, I run ELK on Linux(CentOS7). Because of security issue, I need to run Auditbeat with non-root user. When runing Auditbeat with non-root user, it shows: 2019-08 WARN [cfgwarn] host/host.go:167 BETA: The system/host dataset is beta 2019-08 WARN [cfgwarn] login/login.go:95 BETA: The system/login dataset is beta 2019-08 WARN [cfgwarn] package/package.go:169 BETA: The system/package dataset is beta 2019-08 WARN [cfgwarn] …

Hope this helps!

---

<div class="post-metadata">

**Author:** ![irobot678](https://avatars.discourse-cdn.com/v4/letter/i/54ee81/32.png) [@irobot678](https://discuss.elastic.co/u/irobot678)\
**Post date:** [January 2, 2020, 6:46am UTC](https://discuss.elastic.co/t/auditbeat-permission-error/213318/3 "2020-01-02T06:46:34Z")

</div>

HI @Dain.Perkins ,

thanks for the response , i have followed the thread but i'm getting the following error:

```
Exiting: 1 error: 1 error: failed to create audit client: failed to open audit netlink socket: bind failed: operation not permitted

Exiting: 1 error: 1 error: failed to create audit client: failed to open audit netlink socket: bind failed: operation not permitted

```

Please help me solve it.

---

<div class="post-metadata">

**Author:** ![Dain.Perkins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dain.perkins/32/41143_2.png) [@Dain.Perkins](https://discuss.elastic.co/u/Dain.Perkins)\
**Post date:** [January 6, 2020, 12:14pm UTC](https://discuss.elastic.co/t/auditbeat-permission-error/213318/4 "2020-01-06T12:14:54Z")

</div>

@irobot678

does it work if you run it without the socket dataset enabled, or if you run it as root?

My guess is that the permission changes weren't successful/sufficient to grant the appropriate permissions to the user executing auditbeat.

Do you have the output from the setcap command?

Thanks  
/dain

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 27, 2020, 12:14pm UTC](https://discuss.elastic.co/t/auditbeat-permission-error/213318/5 "2020-01-27T12:14:58Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.