# Can I run Auditbeat as a non-root user?

**URL:** <https://discuss.elastic.co/t/can-i-run-auditbeat-as-a-non-root-user/230380>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [April 29, 2020, 1:47pm UTC](https://discuss.elastic.co/t/can-i-run-auditbeat-as-a-non-root-user/230380 "2020-04-29T13:47:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ffknob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ffknob/32/37008_2.png) [@ffknob](https://discuss.elastic.co/u/ffknob)\
**Post date:** [April 29, 2020, 1:47pm UTC](https://discuss.elastic.co/t/can-i-run-auditbeat-as-a-non-root-user/230380/1 "2020-04-29T13:47:00Z")

</div>

Hi

I'm setting up the Beats. For each one I followed the following process:

1. Created and user called `elastic` in the host

2. Created a systemd unit file like this:

```auto
[Unit]
Description=Auditbeat
After=syslog.target network.target

[Service]
PIDFile=/run/auditbeat.pid
ExecStart=/u/elastic/auditbeat/auditbeat -c /u/elastic/auditbeat/auditbeat.yml
ExecStop=/bin/kill -s QUIT $MAINPID
User=elastic
Group=elastic

[Install]
WantedBy=multi-user.target

```

1. But when I try to run Auditbeat, I get this

```auto
$ ./auditbeat -e
2020-04-29T10:41:48.012-0300	ERROR	instance/beat.go:933	Exiting: 1 error: 1 error: unable to create DNS sniffer: failed creating af_packet sniffer: operation not permitted
Exiting: 1 error: 1 error: unable to create DNS sniffer: failed creating af_packet sniffer: operation not permitted

```

So, can I run Auditbeat as a non-root user?

What about the other Beats? Filebeat, for instance, also looks like not, if it's configured to index /var/log/messages for example...

Thank you

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 7, 2020, 3:22pm UTC](https://discuss.elastic.co/t/can-i-run-auditbeat-as-a-non-root-user/230380/2 "2020-05-07T15:22:28Z")

</div>

> So, can I run Auditbeat as a non-root user?

It should be possible, but only if you give it the appropriate capabilities to process and set the config file permissions/owner. Those permissions will depend on what features you are using. It's needs a lot of permissions to be able to monitor everything.

For the auditd module it needs AUDIT\_CONTROL and AUDIT\_READ. [Run Auditbeat on Docker | Auditbeat Reference [7.16] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/7.x/running-on-docker.html#_special_requirements)

For file integrity, it needs to be able read any files that it's monitoring.

For the system module it's a little more complicated. The system/network dataset requires several permissions. The error you posted should be addressed by adding CAP\_SETPCAP capability. Then the modules uses perf to monitor the network and processes so it probably needs CAP\_SYSADMIN.

For adding capabilties with systemd see [systemd.exec](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Capabilities).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 28, 2020, 3:22pm UTC](https://discuss.elastic.co/t/can-i-run-auditbeat-as-a-non-root-user/230380/3 "2020-05-28T15:22:32Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.