# Elastic ML Node violating seccomp dac-decision

**URL:** https://discuss.elastic.co/t/elastic-ml-node-violating-seccomp-dac-decision/201905
**Category:** Beats
**Tags:** auditbeat
**Created:** [October 2, 2019, 8:19am UTC](https://discuss.elastic.co/t/elastic-ml-node-violating-seccomp-dac-decision/201905 "2019-10-02T08:19:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [October 2, 2019, 8:19am UTC](https://discuss.elastic.co/t/elastic-ml-node-violating-seccomp-dac-decision/201905/1 "2019-10-02T08:19:27Z")

</div>

Hello,

Not sure what to think of the following auditbeat events originating from our ml node:

```
{
  "_index": "auditbeat-7.3.2-2019.10.02",
  "_type": "_doc",
  "_id": "7H-Di20Bk8gLhUqu1B6e",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2019-10-02T08:08:52.221Z",
    "service": {
      "type": "auditd"
    },
    "host": {
      "containerized": false,
      "ip": [
      ],
      "mac": [
      ],
      "architecture": "x86_64",
      "os": {
        "kernel": "3.10.0-957.27.2.el7.x86_64",
        "codename": "Core",
        "platform": "centos",
        "version": "7 (Core)",
        "family": "redhat",
        "name": "CentOS Linux"
      },
      "id": "926dcc530cb84e5f991c17455be1ffac"
    },
    "agent": {
      "version": "7.3.2",
      "type": "auditbeat",
    },
    "ecs": {
      "version": "1.0.1"
    },
    "event": {
      "outcome": "unknown",
      "module": "auditd",
      "category": "dac-decision",
      "action": "violated-seccomp-policy"
    },
    "user": {
      "group": {
        "id": "992",
        "name": "elasticsearch"
      },
      "selinux": {
        "domain": "unconfined_service_t",
        "level": "s0",
        "role": "system_r",
        "user": "system_u"
      },
      "id": "996",
      "name": "elasticsearch"
    },
    "process": {
      "pid": 107132,
      "name": "autodetect"
    },
    "auditd": {
      "summary": {
        "object": {
          "primary": "25",
          "type": "process"
        },
        "how": "autodetect",
        "actor": {
          "secondary": "elasticsearch",
          "primary": "unset"
        }
      },
      "message_type": "seccomp",
      "sequence": 7016762,
      "result": "unknown",
      "data": {
        "sig": "0",
        "code": "0x50000",
        "ip": "0x7fd5bec607ba",
        "syscall": "25",
        "arch": "c000003e",
        "compat": "0"
      }
    }
  }
}

```

Grtz

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 23, 2019, 8:19am UTC](https://discuss.elastic.co/t/elastic-ml-node-violating-seccomp-dac-decision/201905/2 "2019-10-23T08:19:28Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.