# Auditbeat socket dataset doesn't correlate process info **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [January 12, 2021, 2:56pm UTC](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844 "2021-01-12T14:56:35Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![bolemebrige](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bolemebrige/32/77609_2.png) [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Post date:** [January 12, 2021, 2:56pm UTC](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844/1 "2021-01-12T14:56:35Z")
Why are some events in my socket dataset missing process info? ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [January 12, 2021, 4:30pm UTC](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844/2 "2021-01-12T16:30:35Z")
Hey @bolemebrige, welcome to discuss 🙂 Could you give more details about the kind of sockets or processes you are missing this info from? What version of Auditbeat are you running? Is it running as root? Not sure if related, but there is an open issue that mentions reliability issues on process enrichment under some circumstances: [https://github.com/elastic/beats/issues/17444](https://github.com/elastic/beats/issues/17444) ---
**Author:** ![bolemebrige](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bolemebrige/32/77609_2.png) [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Post date:** [January 12, 2021, 5:32pm UTC](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844/3 "2021-01-12T17:32:15Z")
I'm running version 7.10. So some events in socket dataset are simply missing info about process that is related to that event. auditbeat is run with sudo service auditbeat start. Some are missing only process.name and some are missing both process.name and process.pid. Example 1: | | Time | process.name | process.pid | source.port | destination.port | event.type | network.direction | | --- | --- | --- | --- | --- | --- | --- | --- | | | Jan 12, 2021 @ 18:25:15.626 | - | 20,840 | 52,143 | 443 | info, connection | inbound | | | Jan 12, 2021 @ 18:25:07.626 | - | 20,840 | 55,993 | 80 | info, connection | inbound | | | Jan 12, 2021 @ 18:25:07.626 | - | 20,840 | 55,994 | 443 | info, connection | inbound | | | Jan 12, 2021 @ 18:24:05.626 | - | 20,840 | 55,988 | 443 | info, connection | inbound | | | Jan 12, 2021 @ 18:24:05.626 | - | 20,840 | 55,986 | 80 | info, connection | inbound | | | Jan 12, 2021 @ 18:23:40.627 | - | 20,840 | 34,852 | 80 | info, connection | inbound | | | Jan 12, 2021 @ 18:23:40.626 | - | 20,840 | 57,732 | 443 | info, connection | inbound | Example 2. | | Time | process.name | process.pid | source.port | destination.port | event.type | network.direction | | --- | --- | --- | --- | --- | --- | --- | --- | | | Jan 12, 2021 @ 18:09:16.626 | - | - | 443 | 59,780 | info, connection | unknown | | | Jan 12, 2021 @ 18:09:12.626 | - | - | 443 | 57,144 | info, connection | unknown | | | Jan 12, 2021 @ 18:09:01.626 | - | - | 443 | 49,064 | info, connection | unknown | | | Jan 12, 2021 @ 18:08:51.626 | - | - | 443 | 42,194 | info, connection | unknown | | | Jan 12, 2021 @ 18:05:59.626 | - | - | 443 | 60,377 | info, connection | unknown | | | Jan 12, 2021 @ 17:25:59.626 | - | - | 443 | 59,677 | info, connection | unknown | ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [January 12, 2021, 6:28pm UTC](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844/4 "2021-01-12T18:28:52Z")
Hi @bolemebrige, Which kernel version and Linux distro are you using? Can you share some [debug logs?](https://www.elastic.co/guide/en/beats/auditbeat/current/enable-auditbeat-debugging.html) ---
**Author:** ![bolemebrige](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bolemebrige/32/77609_2.png) [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Post date:** [January 13, 2021, 10:08am UTC](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844/5 "2021-01-13T10:08:49Z")
Linux version 4.19.0-11-amd64 ([debian-kernel@lists.debian.org](mailto:debian-kernel@lists.debian.org)) (gcc version 8.3.0 (Debian 8.3.0-6)) #1 SMP Debian 4.19.146-1 (2020-09-17) When I run auditbat -e there is no any error logs although I get events with same problem... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 10, 2021, 12:09pm UTC](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844/6 "2021-02-10T12:09:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.