# Auditbeat - Running as non-root user, will likely not report all processes **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [July 1, 2019, 12:09pm UTC](https://discuss.elastic.co/t/auditbeat-running-as-non-root-user-will-likely-not-report-all-processes/188310 "2019-07-01T12:09:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [July 1, 2019, 12:09pm UTC](https://discuss.elastic.co/t/auditbeat-running-as-non-root-user-will-likely-not-report-all-processes/188310/1 "2019-07-01T12:09:19Z")
Hello, Trying out the process module for auditbeat on Windows. Seeinq the following message: ``` |2019-07-01T14:02:55.289+0200|WARN|[cfgwarn]|process/process.go:131|BETA: The system/process dataset is beta| |---|---|---|---|---| |2019-07-01T14:02:55.306+0200|DEBUG|[process]|process/process.go:168|Last state was sent at 2019-07-01 09:01:25.3942751 +0200 CEST. Next state update by 2019-07-01 21:01:25.3942751 +0200 CEST.| |2019-07-01T14:02:55.306+0200|WARN|[process]|process/process.go:174|Running as non-root user, will likely not report all processes.| ``` As auditbeat is running as SYSTEM, it should have all the required permissions to list all processes.. Is this a bug (where auditbeat think it's running on Linux and checking for root privilege?) Willem ---
**Author:** ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)\ **Post date:** [July 1, 2019, 1:45pm UTC](https://discuss.elastic.co/t/auditbeat-running-as-non-root-user-will-likely-not-report-all-processes/188310/2 "2019-07-01T13:45:28Z")
Hi Willem, thanks for reaching out. Do you see those errors when running auditbeat as a Windows service (`Start-Service auditbeat`), or are you starting auditbeat manually (`./auditbeat -e`)? Thanks. ---
**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\ **Post date:** [July 1, 2019, 3:45pm UTC](https://discuss.elastic.co/t/auditbeat-running-as-non-root-user-will-likely-not-report-all-processes/188310/3 "2019-07-01T15:45:56Z")
Hi @willemdh - that's a bug, we should not be showing this warning on Windows. I'll get it fixed, but it shouldn't have any impact on what data is collected. ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [July 2, 2019, 2:01pm UTC](https://discuss.elastic.co/t/auditbeat-running-as-non-root-user-will-likely-not-report-all-processes/188310/4 "2019-07-02T14:01:50Z")
Thanks, I'll ignore for now. By the way, we noticed auditbeat has crashed several times since enabling the host and process metricset on WIndows Server 2012 R2 and 2016. Enabled debug, but nothing is logged which could point to the root cause. ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [July 3, 2019, 11:14am UTC](https://discuss.elastic.co/t/auditbeat-running-as-non-root-user-will-likely-not-report-all-processes/188310/5 "2019-07-03T11:14:21Z")
Hello, The problematic module on Windows Server 2012 R2 is: ``` - module: system datasets: - process period: 1s ``` Grtz ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 24, 2019, 11:14am UTC](https://discuss.elastic.co/t/auditbeat-running-as-non-root-user-will-likely-not-report-all-processes/188310/6 "2019-07-24T11:14:32Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.