I have installed auditbeat (latest version). This is my config file (I hid the output.logstash/kibana part as it's irrelevant and has sensitive data. Also, it doesn't even have audit rules - it didn't work before so I removed it) When I start auditbeat, this is what I get: {"level":"error","times…

This is an error from - socket under system module. This one will also not work on such an old kernel. My suggestion is that you disable everything except - login: - module: system datasets: - login state.period: 30s All the other modules must be removed.

Can't start auditbeat

Elastic Stack Beats

aaron-nimocks (Aaron Nimocks) November 11, 2020, 4:26pm 2

What do you get when you run auditbeat test config and auditbeat test outout?

1 Like

Topic		Replies	Views
AuditBeat failed to create audit client: protocol not supported Beats auditbeat	6	2219	November 4, 2022
Service does not start - 1 error: 1 error: failed to create audit client: failed to create audit client: audit not supported by kernel: protocol not supported Beats auditbeat	3	1345	September 26, 2019
I am unable to Start Auditbeat service Beats auditbeat	20	948	January 6, 2021
Metricset 'audit/kernel' is not registered, module not found Beats auditbeat	6	1687	November 4, 2022
Auditbeat randomly shuts down Beats auditbeat	24	1966	November 4, 2022

Can't start auditbeat

Related topics