# Auditbeat wont start

**URL:** <https://discuss.elastic.co/t/auditbeat-wont-start/266491>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [March 7, 2021, 10:00pm UTC](https://discuss.elastic.co/t/auditbeat-wont-start/266491 "2021-03-07T22:00:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ethrbunny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethrbunny/32/34603_2.png) [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\
**Post date:** [March 7, 2021, 10:00pm UTC](https://discuss.elastic.co/t/auditbeat-wont-start/266491/1 "2021-03-07T22:00:53Z")

</div>

I get 3 different errors msgs:

unable to guess one or more required parameters: guess\_sockaddr\_in failed  
-or-  
unable to guess one or more required parameters: guess\_udp\_sendmsg failed  
-or-  
unable to guess one or more required parameters: guess\_sk\_buff\_proto failed

```
# /etc/auditbeat# uname -a
Linux pirepo 3.16.0-10-amd64 #1 SMP Debian 3.16.81-1 (2020-01-17) x86_64 GNU/Linux

```

auditbeat.yml:

> auditbeat.modules:
> 
> - module: auditd  
> audit\_rule\_files: ['${path.config}/audit.rules.d/\*.conf']  
> audit\_rules: |
> 
> - module: file\_integrity  
> paths:
> 
> - module: system  
> datasets:  
> state.period: 12h  
> user.detect\_password\_changes: true  
> login.wtmp\_file\_pattern: /var/log/wtmp\*  
> login.btmp\_file\_pattern: /var/log/btmp\*  
> socket.enable\_ipv6: false  
> processors:
> 
> logging.level: warning

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2021, 12:01am UTC](https://discuss.elastic.co/t/auditbeat-wont-start/266491/2 "2021-04-05T00:01:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.