# Auditd events created while Auditbeat is down

**URL:** <https://discuss.elastic.co/t/auditd-events-created-while-auditbeat-is-down/266369>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [March 5, 2021, 12:47pm UTC](https://discuss.elastic.co/t/auditd-events-created-while-auditbeat-is-down/266369 "2021-03-05T12:47:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alanoe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alanoe/32/84505_2.png) [@alanoe](https://discuss.elastic.co/u/alanoe)\
**Post date:** [March 5, 2021, 12:47pm UTC](https://discuss.elastic.co/t/auditd-events-created-while-auditbeat-is-down/266369/1 "2021-03-05T12:47:55Z")

</div>

I'm designing a filesystem operations (file creation, file deletion, file open, permissions change, etc) and process executions tracking application using Auditbeat. This tracking app should not lose events in any case, so I'm checking all crash possibilities and how the app could handle them.

1. If Auditbeat crashes, do I lose auditd events until it's restarted ? My understanding is that I would not lose events if auditbeat gets restarted before the kernel event queue fills up. Is that right?

2. If Auditbeat is killed, do I lose auditd events until it's restarted? I hope that the action defined in the failure\_mode config option will be taken (in other words, does Auditbeat handle a SIGTERM/SIGINT OS signal and does whatever is specified in failure\_mode) ? If that is true, I could set the "panic" value in failure\_mode and be sure I would not lose events. I'm aware that Auditbeat would not be notified if it was terminated forcefully with a SIGKILL and can do nothing about it.

3. Most important question: if Auditbeat crashes or is killed, it's not restarted until the kernel event queue fills up and I lose events, will auditbeat detect that when it restarts and log the incident?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2021, 2:48pm UTC](https://discuss.elastic.co/t/auditd-events-created-while-auditbeat-is-down/266369/2 "2021-04-02T14:48:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.