Can't start packetbeat service on Ubuntu 18.04

Elastic Stack Beats
1

Hi!

I can't start packetbeat service in Ubuntu 18.04. It runs perfectly If I start the service exactly after it is installed. But if I stop it or restart it in order to make some changes in packetbeat.yml and then try to start it again, I get the following error:

1
1728×292 134 KB

Does anybody have any idea?

2

Please don't post pictures of text, they are difficult to read, impossible to search and some people may not be even able to see them :slight_smile:

3

Can you paste the text from journalctl -xe or the log file

4

Hello guys!

Thank you for your desire to help me! Finally, I have succeeded in making the service to start. After I have unpacked the packetbeat deb file, I tried to start it, but I forgot to install libpacap. After I have installed libpcap, I still had the error I posted in the picture. After a lot of trials, I have found the solution. I have ran sudo packetbeat test config -e. This last command has saved my life. It printed an error where it was written what command should I run in order to make it start (it was: sudo chmod go-w packetbeat.yml, because I had previously ran sudo chmod 777 packetbeat.yml in order to have the possibility to edit this configuration file). Best luck!