Auditbeat: system/socket dataset setup failed - guess_inet_sock failed: timeout while waiting

[Stefan_Bauer]

Hi folks,

auditbeat fails on 2 Ubuntu 20 systems with the following errors several times a day:

auditbeat[1929153]: {"log.level":"error","@timestamp":"2023-11-23T08:29:49.984+0100","log.origin":{"file.name":"instance/beat.go","file.line":1274},"message":"Exiting: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess_inet_sock failed: timeout while waiting for event","service.name":"auditbeat","ecs.version":"1.6.0"}

auditbeat version 8.9.0 (amd64), libbeat 8.9.0 [dd50d49baeb99e0d21a31adb621908a7f0091046 built 2023-07-19 01:22:57 +0000 UTC]
Linux 5.4.0-166-generic #183-Ubuntu SMP Mon Oct 2 11:28:33 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

# cat /sys/kernel/debug/kprobes/enabled
1
# cat /proc/sys/kernel/ftrace_enabled
1

any help is greatly appreciated.

Stefan