# Can't start auditbeat

**URL:** <https://discuss.elastic.co/t/cant-start-auditbeat/255097>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [November 11, 2020, 4:19pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097 "2020-11-11T16:19:01Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [November 17, 2020, 10:02am UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/21 "2020-11-17T10:02:16Z")

</div>

Back to the original issue, the problem you're experiencing is that the `file_integrity` module requires `inotify` support in the kernel, which yours doesn't have. While the documentation states that inotify is present in kernels 2.6.13 and up, turns out newer versions of the fsnotify library require at least 2.6.27 due to the use of `inotify_init1` syscall.

As you're only interested in the Login Events dashboards, I suggest you disable the `file_integrity` module by adding an `enabled: false` key to its configuration:

```auto
- module: file_integrity
  enabled: false

```

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 17, 2020, 10:08am UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/22 "2020-11-17T10:08:17Z")

</div>

YES! Thank you so much!

It now complains about af\_packet. Can that be disabled too?

```
{"level":"error","timestamp":"2020-11-17T10:07:15.088Z","caller":"instance/beat.go:951","message":"Exiting: 1 error: unable to create DNS sniffer: failed creating af_packet sniffer: no known tpacket versions work on this machine"}
Exiting: 1 error: unable to create DNS sniffer: failed creating af_packet sniffer: no known tpacket versions work on this machine
```

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [November 17, 2020, 10:13am UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/23 "2020-11-17T10:13:55Z")

</div>

This is an error from `- socket` under `system` module. This one will also not work on such an old kernel.

My suggestion is that you disable everything except `- login`:

```auto
- module: system
  datasets:
    - login
  state.period: 30s

```

All the other modules must be removed.

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 17, 2020, 10:17am UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/24 "2020-11-17T10:17:14Z")

</div>

Yes!!!! Thank you SO MUCH!!!

I can not express how much sweat tears and time went over this. I can't thank you enough.

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [November 22, 2020, 10:18am UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/25 "2020-11-22T10:18:32Z")

</div>

Just last thing I wanted to ask.

On those CentOS 5 machines, The beats currently only work with `auditbeat -e` or `filebeat -e`. If I start it as a service (`service filebeat start`) I get:

```
FATAL: kernel too old
/bin/bash: line 1: 27770 Segmentation fault /usr/share/filebeat/bin/filebeat-god -r / -n -p /var/run/filebeat.pid -- /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml --path.home /usr/share/filebeat --path.config /etc/filebeat --path.data /var/lib/filebeat --path.logs /var/log/filebeat

```

Is it at all possible to have it working as a service? If not it's absolutely fine, not a biggie. Just a little nitpicking.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2020, 12:18pm UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097/26 "2020-12-20T12:18:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/cant-start-auditbeat/255097.md?page=1)