# Can't start auditbeat

**URL:** <https://discuss.elastic.co/t/cant-start-auditbeat/255097>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [November 11, 2020, 4:19pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097 "2020-11-11T16:19:01Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 11, 2020, 4:19pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/1 "2020-11-11T16:19:01Z")

</div>

I have installed auditbeat (latest version).

[This is my config file](https://pastebin.com/U7Qr0A36) (I hid the `output.logstash/kibana` part as it's irrelevant and has sensitive data. Also, it doesn't even have audit rules - it didn't work before so I removed it)

When I start auditbeat, this is what I get:

```
{"level":"error","timestamp":"2020-11-11T16:17:28.970Z","caller":"instance/beat.go:951","message":"Exiting: 1 error: failed to initialize file event reader: function not implemented"}
Exiting: 1 error: failed to initialize file event reader: function not implemented

```

Does anyone happen to know why it's happening?

Thanks ahead.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 11, 2020, 4:26pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/2 "2020-11-11T16:26:06Z")

</div>

What do you get when you run `auditbeat test config` and `auditbeat test outout`?

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 11, 2020, 4:28pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/3 "2020-11-11T16:28:47Z")

</div>

Thanks for the response.

I get:

```
[root@server-150 elk]# auditbeat test config
Exiting: 1 error: failed to initialize file event reader: function not implemented

[root@server-150 elk]# auditbeat test output
logstash: *ip*:5044...
  connection...
    parse host... OK
    dns lookup... OK
    addresses: *ip*
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
```

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 11, 2020, 4:33pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/4 "2020-11-11T16:33:21Z")

</div>

Do you get an error when you revert back to the [default yml](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-reference-yml.html)?

Nothing is jumping out to me so I would try to go back to default and run `autditbeat test config` then make adjustments to your yml until you hit an error.

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 11, 2020, 4:36pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/5 "2020-11-11T16:36:23Z")

</div>

I had the same error with the default file, I thought maybe if I would put the one I usually use on other servers it would be solved.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 11, 2020, 5:01pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/6 "2020-11-11T17:01:21Z")

</div>

When you say current version is that 7.10? I download and looked at the default for that. Update the ES output and give that a shot.

```auto
auditbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.period: 10s
  reload.enabled: false

auditbeat.max_start_delay: 10s

auditbeat.modules:
- module: file_integrity
  paths:
  - /bin
  - /usr/bin
  - /usr/local/bin
  - /sbin
  - /usr/sbin
  - /usr/local/sbin

  exclude_files:
  - '\.DS_Store$'
  - '\.swp$'
  scan_at_start: true
  scan_rate_per_sec: 50 MiB
  max_file_size: 100 MiB
  hash_types: [sha1]
  recursive: false

- module: system
  datasets:
    - package 

  period: 2m 

- module: system
  datasets:
    - host    
    - process 
  state.period: 12h
  process.hash.scan_rate_per_sec: 50 MiB
  process.hash.max_file_size: 100 MiB
  process.hash.hash_types: [sha1]

output.elasticsearch:
  hosts: ["localhost:9200"]

setup.template.settings:

setup.kibana:

logging.to_files: true
logging.files:

```

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 11, 2020, 5:04pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/7 "2020-11-11T17:04:07Z")

</div>

Sorry, my bad then. It's 7.9.3

```
[root@server-150 ~] #auditbeat version
auditbeat version 7.9.3 (386), libbeat 7.9.3 [7aab6a9659749802201db8020c4f04b74cec2169 built 2020-10-16 09:11:37 +0000 UTC]

```

does it still apply? Should I still change anything in the config?

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 11, 2020, 5:14pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/8 "2020-11-11T17:14:24Z")

</div>

Yes. Try to change it.

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 11, 2020, 5:18pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/9 "2020-11-11T17:18:51Z")

</div>

My ES output is commented out completely though, I only defined output to logstash.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 11, 2020, 5:21pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/10 "2020-11-11T17:21:08Z")

</div>

That's just the default config. Remove es output and put your logstash info.

But running `auditbeat test config` with an `OK` result is what you need to get to first. Your current config is not passing so need to figure out which part is breaking it.

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 11, 2020, 5:26pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/11 "2020-11-11T17:26:24Z")

</div>

Thanks for the response,

I pasted in the config you provided and got the same response 😕

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 11, 2020, 5:35pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/12 "2020-11-11T17:35:32Z")

</div>

I'm not sure what's going on then. Maybe the easiest way is to remove this installation and [try a fresh one](https://www.elastic.co/guide/en/beats/auditbeat/7.9/auditbeat-installation-configuration.html).

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 11, 2020, 6:17pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/13 "2020-11-11T18:17:17Z")

</div>

I reinstalled and got the same error (with default).

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 11, 2020, 6:19pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/14 "2020-11-11T18:19:04Z")

</div>

May this can provide more info? I don't get an ok on config test with the default configuration.

```
2020-11-11T18:18:08.057Z INFO instance/beat.go:299 Setup Beat: auditbeat; Version: 7.9.3
2020-11-11T18:18:08.057Z INFO [index-management] idxmgmt/std.go:184 Set output.elasticsearch.index to 'auditbeat-7.9.3' as ILM is enabled.
2020-11-11T18:18:08.057Z INFO eslegclient/connection.go:99 elasticsearch url: http://localhost:9200
2020-11-11T18:18:08.058Z INFO [publisher] pipeline/module.go:113 Beat name: RATE-PS-16_75
2020-11-11T18:18:08.058Z INFO [auditd] auditd/audit_linux.go:106 auditd module is running as euid=0 on kernel=2.6.18-164.el5
2020-11-11T18:18:08.058Z INFO [auditd] auditd/audit_linux.go:133 socket_type=unicast will be used.
2020-11-11T18:18:08.058Z INFO instance/beat.go:419 auditbeat stopped.
2020-11-11T18:18:08.061Z ERROR instance/beat.go:951 Exiting: 1 error: failed to initialize file event reader: function not implemented
Exiting: 1 error: failed to initialize file event reader: function not implemented
```

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [November 11, 2020, 7:04pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/15 "2020-11-11T19:04:45Z")

</div>

Just an FYI, based off of

> 2020-11-11T18:18:08.058Z INFO [auditd] auditd/audit\_linux.go:106 auditd module is running as euid=0 on kernel=2.6.18-164.el5

It looks like you're running this on CentOS 5.4. It doesn't look like Auditbeat is tested against CentOS 5.4.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 11, 2020, 7:35pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/16 "2020-11-11T19:35:45Z")

</div>

@BenB196 I'd agree with this and unfortunately I am not able to easily test against that version.

@headtea If you are able to test on a newer OS I would start there. If you aren't able to upgrade then you can try to install Filebeats and use the Auditd module. As long as auditd is creating the logs you want in `/var/log/audit/` then it should pick them up.

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 11, 2020, 7:51pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/17 "2020-11-11T19:51:32Z")

</div>

Thanks for the response. Filebeat is indeed working on that CentOS 5 machine.

To be honest, the only thing I use auditbeat for is one of its default "Login events" dashboards.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/1/51a118918b3eec545b8e194fb110861955788786.png)

Is there a way I could ship the same information with filebeat so it would end in this exact dashboard?

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 11, 2020, 7:58pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/18 "2020-11-11T19:58:53Z")

</div>

If your auditd is setup to capture that you can use [Filebeat with Auditd module](https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-auditd.html). Here are the [fields](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-auditd.html) it can give you.

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 11, 2020, 8:11pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/19 "2020-11-11T20:11:20Z")

</div>

Thank you so much for this!

Do you happen to know what auditd needs to be setup with to capture this? And how to have it end up on that dashboard? it seems like this module would create a separate one

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 11, 2020, 8:22pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/20 "2020-11-11T20:22:28Z")

</div>

I do not know the correct auditd rules to set for that OS version, sorry. You might be capturing already and can check the `/var/log/audit/*` folder to see.

The dashboard is a new one but you can pick the individual visualization that you want and add it to an existing dashboard.

[Next page](https://discuss.elastic.co/t/cant-start-auditbeat/255097.md?page=2)