# AuditBeat Will Not Start **URL:** \ **Category:** Beats\ **Created:** [November 29, 2019, 9:51pm UTC](https://discuss.elastic.co/t/auditbeat-will-not-start/210005 "2019-11-29T21:51:46Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![nuffskillz](https://avatars.discourse-cdn.com/v4/letter/n/85e7bf/32.png) [@nuffskillz](https://discuss.elastic.co/u/nuffskillz)\ **Post date:** [November 29, 2019, 9:51pm UTC](https://discuss.elastic.co/t/auditbeat-will-not-start/210005/1 "2019-11-29T21:51:46Z")
Hi A fresh install of auditbeat will not start returning the following below. Exiting: 1 error: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess\_sk\_buff\_proto failed: failed to monitor probe: PERF\_EVENT\_IOC\_ID: inappropriate ioctl for device ``` cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.5 (Santiago) uname -a Linux REMOVED -HOSTNAME 2.6.32-431.el6.x86_64 #1 SMP Sun Nov 10 22:19:54 EST 2013 x86_64 x86_64 x86_64 GNU/Linux rpm -qa |grep -i auditbeat auditbeat-7.4.2-1.x86_64 ``` auditbeat -e -d "\*" 2019-11-29T16:09:36.918-0500 INFO instance/beat.go:607 Home path: [/usr/share/auditbeat] Config path: [/etc/auditbeat] Data path: [/var/lib/auditbeat] Logs path: [/var/log/auditbeat] 2019-11-29T16:09:36.918-0500 DEBUG [beat] instance/beat.go:659 Beat metadata path: /var/lib/auditbeat/meta.json 2019-11-29T16:09:36.918-0500 INFO instance/beat.go:615 Beat ID: 2e50be9a-9e4b-485b-9538-0d430fd41edb 2019-11-29T16:09:36.921-0500 DEBUG [filters] add\_cloud\_metadata/providers.go:126 add\_cloud\_metadata: starting to fetch metadata, timeout=3s 2019-11-29T16:09:39.921-0500 DEBUG [filters] add\_cloud\_metadata/providers.go:169 add\_cloud\_metadata: timed-out waiting for all responses 2019-11-29T16:09:39.921-0500 DEBUG [filters] add\_cloud\_metadata/providers.go:129 add\_cloud\_metadata: fetchMetadata ran for 3.00034529s 2019-11-29T16:09:39.921-0500 INFO add\_cloud\_metadata/add\_cloud\_metadata.go:87 add\_cloud\_metadata: hosting provider type not detected. 2019-11-29T16:09:39.921-0500 DEBUG [processors] processors/processor.go:101 Generated new processors: add\_host\_metadata=[netinfo.enabled=[false], cache.ttl=[5m0s]], add\_cloud\_metadata=null 2019-11-29T16:09:39.921-0500 INFO [seccomp] seccomp/seccomp.go:101 Syscall filter could not be installed because the kernel does not support seccomp 2019-11-29T16:09:39.921-0500 INFO [beat] instance/beat.go:903 Beat info {"system\_info": {"beat": {"path": {"config": "/etc/auditbeat", "data": "/var/lib/auditbeat", "home": "/usr/share/auditbeat", "logs": "/var/log/auditbeat"}, "type": "auditbeat", "uuid": "2e50be9a-9e4b-485b-9538-0d430fd41edb"}}} 2019-11-29T16:09:39.921-0500 INFO [beat] instance/beat.go:912 Build info {"system\_info": {"build": {"commit": "15075156388b44390301f070960fd8aeac1c9712", "libbeat": "7.4.2", "time": "2019-10-28T19:43:11.000Z", "version": "7.4.2"}}} 2019-11-29T16:09:39.921-0500 INFO [beat] instance/beat.go:915 Go runtime info {"system\_info": {"go": {"os":"linux","arch":"amd64","max\_procs":40,"version":"go1.12.9"}}} 2019-11-29T16:09:39.923-0500 INFO [beat] instance/beat.go:919 Host info {"system\_info": {"host": {"architecture":"x86\_64","boot\_time":"2016-09-28T12:20:09-04:00","containerized":false,"name":"[serverhost.someserver.com](http://serverhost.someserver.com)","ip":["127.0.0.1/8","10.248.1.6/25","10.248.1.132/25"],"kernel\_version":"2.6.32-431.el6.x86\_64","mac":["fc:5b:39:2d:5a:76","fc:5b:39:2d:5a:77"],"os":{"family":"redhat","platform":"redhat","name":"Red","version":"6.5 (Santiago)","major":6,"minor":5,"patch":0,"codename":"Santiago"},"timezone":"EST","timezone\_offset\_sec":-18000,"id":"bdf26306c00c44ac223a2bd80000000d"}}} 2019-11-29T16:09:39.923-0500 INFO [beat] instance/beat.go:948 Process info {"system\_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read","38","39","40","41","42","43","44","45","46","47","48","49","50","51","52","53","54","55","56","57","58","59","60","61","62","63"],"effective":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read","38","39","40","41","42","43","44","45","46","47","48","49","50","51","52","53","54","55","56","57","58","59","60","61","62","63"],"bounding":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read","38","39","40","41","42","43","44","45","46","47","48","49","50","51","52","53","54","55","56","57","58","59","60","61","62","63"],"ambient":null}, "cwd": "/var/log", "exe": "/usr/share/auditbeat/bin/auditbeat", "name": "auditbeat", "pid": 28895, "ppid": 27852, "seccomp": {"mode":""}, "start\_time": "2019-11-29T16:09:36.050-0500"}}} 2019-11-29T16:09:39.923-0500 INFO instance/beat.go:292 Setup Beat: auditbeat; Version: 7.4.2 2019-11-29T16:09:39.923-0500 DEBUG [beat] instance/beat.go:318 Initializing output plugins 2019-11-29T16:09:39.923-0500 INFO [index-management] idxmgmt/std.go:178 Set output.elasticsearch.index to 'auditbeat-7.4.2' as ILM is enabled. 2019-11-29T16:09:39.924-0500 INFO elasticsearch/client.go:170 Elasticsearch url: [http://localhost:9200](http://localhost:9200) 2019-11-29T16:09:39.924-0500 DEBUG [publisher] pipeline/consumer.go:137 start pipeline event consumer 2019-11-29T16:09:39.924-0500 INFO [publisher] pipeline/module.go:97 Beat name: [serverhost.someserver.com](http://serverhost.someserver.com) 2019-11-29T16:09:39.924-0500 DEBUG [modules] beater/metricbeat.go:121 Available modules and metricsets: Register [ModuleFactory:[system], MetricSetFactory:[auditd/auditd, file\_integrity/file, system/host, system/login, system/package, system/process, system/socket, system/user]] 2019-11-29T16:09:39.924-0500 INFO [auditd] auditd/audit\_linux.go:106 auditd module is running as euid=0 on kernel=2.6.32-431.el6.x86\_64 2019-11-29T16:09:39.924-0500 INFO [auditd] auditd/audit\_linux.go:133 socket\_type=unicast will be used. 2019-11-29T16:09:39.925-0500 DEBUG [file\_integrity] file\_integrity/metricset.go:97 Initialized the file event reader. Running as euid=0 2019-11-29T16:09:39.926-0500 WARN [cfgwarn] host/host.go:167 BETA: The system/host dataset is beta 2019-11-29T16:09:39.926-0500 DEBUG [system] host/host.go:450 No last host information found on disk. 2019-11-29T16:09:39.926-0500 WARN [cfgwarn] login/login.go:95 BETA: The system/login dataset is beta 2019-11-29T16:09:39.927-0500 DEBUG [login] login/utmp.go:539 Restored 0 UTMP file records from disk 2019-11-29T16:09:39.927-0500 DEBUG [login] login/utmp.go:571 Restored 0 open login sessions from disk 2019-11-29T16:09:39.927-0500 WARN [cfgwarn] package/package.go:170 BETA: The system/package dataset is beta 2019-11-29T16:09:39.927-0500 DEBUG [package] package/package.go:203 No state timestamp found 2019-11-29T16:09:39.927-0500 DEBUG [package] package/package.go:211 Restored 0 packages from disk 2019-11-29T16:09:39.927-0500 WARN [cfgwarn] process/process.go:131 BETA: The system/process dataset is beta 2019-11-29T16:09:39.927-0500 DEBUG [process] process/process.go:170 No state timestamp found 2019-11-29T16:09:39.927-0500 WARN [cfgwarn] socket/socket\_linux.go:81 BETA: The system/socket dataset is beta. 2019-11-29T16:09:39.927-0500 INFO [socket] socket/socket\_linux.go:197 Setting up system/socket for kernel 2.6.32-431.el6.x86\_64 2019-11-29T16:09:39.928-0500 DEBUG [socket] socket/socket\_linux.go:245 IPv6 supported: false 2019-11-29T16:09:39.928-0500 DEBUG [socket] socket/socket\_linux.go:252 IPv6 enabled: false 2019-11-29T16:09:39.981-0500 DEBUG [socket] socket/socket\_linux.go:305 Selected kernel function sys\_newuname for SYS\_UNAME 2019-11-29T16:09:39.981-0500 DEBUG [socket] socket/socket\_linux.go:305 Selected kernel function ip\_local\_out for IP\_LOCAL\_OUT 2019-11-29T16:09:39.981-0500 DEBUG [socket] socket/socket\_linux.go:305 Selected kernel function \_\_skb\_recv\_datagram for RECV\_UDP\_DATAGRAM 2019-11-29T16:09:39.981-0500 DEBUG [socket] socket/socket\_linux.go:305 Selected kernel function sys\_execve for SYS\_EXECVE 2019-11-29T16:09:39.981-0500 DEBUG [socket] socket/socket\_linux.go:305 Selected kernel function sys\_gettimeofday for SYS\_GETTIMEOFDAY 2019-11-29T16:09:39.984-0500 INFO [socket] guess/guess.go:258 Running 16 guesses ... 2019-11-29T16:09:39.984-0500 DEBUG [socket] guess/guess.go:270 Guess guess\_inet\_sock\_ipv6 skipped. 2019-11-29T16:09:39.991-0500 WARN [cfgwarn] user/user.go:205 BETA: The system/user dataset is beta 2019-11-29T16:09:39.992-0500 DEBUG [user] user/user.go:247 No state timestamp found 2019-11-29T16:09:39.992-0500 DEBUG [user] user/user.go:255 Restored 0 users from disk 2019-11-29T16:09:39.992-0500 INFO instance/beat.go:385 auditbeat stopped. 2019-11-29T16:09:39.992-0500 ERROR instance/beat.go:878 Exiting: 1 error: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess\_sk\_buff\_proto failed: failed to monitor probe: PERF\_EVENT\_IOC\_ID: inappropriate ioctl for device Exiting: 1 error: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess\_sk\_buff\_proto failed: failed to monitor probe: PERF\_EVENT\_IOC\_ID: inappropriate ioctl for device ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 20, 2019, 9:58pm UTC](https://discuss.elastic.co/t/auditbeat-will-not-start/210005/2 "2019-12-20T21:58:53Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed. ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [February 20, 2020, 8:35pm UTC](https://discuss.elastic.co/t/auditbeat-will-not-start/210005/3 "2020-02-20T20:35:39Z")
Newer versions of Centos 6 work, but not 6.5. See [https://www.elastic.co/guide/en/beats/auditbeat/7.x/auditbeat-dataset-system-socket.html#\_requirements](https://www.elastic.co/guide/en/beats/auditbeat/7.x/auditbeat-dataset-system-socket.html#_requirements).