# Error: system/socket dataset setup failed **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [March 8, 2020, 1:38pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603 "2020-03-08T13:38:52Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![rowe](https://avatars.discourse-cdn.com/v4/letter/r/e68b1a/32.png) [@rowe](https://discuss.elastic.co/u/rowe)\ **Post date:** [March 8, 2020, 1:38pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/1 "2020-03-08T13:38:52Z")
![auditbeat](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f363971c39a22b7ea19d86c75b210c759073d23d.png) Hi! I'm new at this and trying to get Auditbeat running on my Synology NAS (DS918+, x86\_64) but there are errors when I try to start it (with ./auditbeat -e). Can anyone tell me if there is something I can do to fix it, or if it just won't work with the current kernel (?). Thanks! ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [March 9, 2020, 8:21am UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/2 "2020-03-09T08:21:38Z")
Hi @rowe, could you please check if you have these directories are present: "/sys/kernel/tracing" and "/sys/kernel/debug"? ---
**Author:** ![rowe](https://avatars.discourse-cdn.com/v4/letter/r/e68b1a/32.png) [@rowe](https://discuss.elastic.co/u/rowe)\ **Post date:** [March 9, 2020, 7:49pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/3 "2020-03-09T19:49:12Z")
Hi @mtojek, thank you for replying. I have the /sys/kernel/debug directory, but not the tracing directory. root@DS918:/sys/kernel/debug# ls acpi bdi btrfs clk dma\_buf dri extfrag fault\_around\_bytes gpio hid intel\_lpss kvm mce pinctrl pm\_qos ras regmap sched\_features sleep\_time sunrpc suspend\_s Permissions: drwx------ 20 root root 0 Mar 1 10:37 debug Any ideas? ---
**Author:** ![jdelvecchio](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@jdelvecchio](https://discuss.elastic.co/u/jdelvecchio)\ **Post date:** [March 10, 2020, 11:20am UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/4 "2020-03-10T11:20:10Z")
This happens to me aswell on all my servers ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [March 10, 2020, 11:49am UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/5 "2020-03-10T11:49:32Z")
I can refer you to this guide I found: [https://lwn.net/Articles/365835/](https://lwn.net/Articles/365835/) Could you please verify that your kernel supports ftrace? I think it's a system issue not a beat one. ---
**Author:** ![jdelvecchio](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@jdelvecchio](https://discuss.elastic.co/u/jdelvecchio)\ **Post date:** [March 11, 2020, 11:46am UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/6 "2020-03-11T11:46:51Z")
My kernel is 3.13.0-170-generic and supports ftrace yes ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [March 11, 2020, 11:50am UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/7 "2020-03-11T11:50:08Z")
Still, missing "tracing" part doesn't sound like a problem with beats. Please verify if ftrace is properly configured. ---
**Author:** ![jdelvecchio](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@jdelvecchio](https://discuss.elastic.co/u/jdelvecchio)\ **Post date:** [March 11, 2020, 11:53am UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/8 "2020-03-11T11:53:44Z")
``` [root@server tracing]# wc -l trace 127014 trace [root@server tracing]# cat current_tracer nop [root@server tracing]# cat tracing_on 1 ``` ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [March 11, 2020, 2:52pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/9 "2020-03-11T14:52:21Z")
@jdelvecchio The issue described by @rowe included missing "tracing" mount. Are you talking about the same issue? ---
**Author:** ![jdelvecchio](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@jdelvecchio](https://discuss.elastic.co/u/jdelvecchio)\ **Post date:** [March 11, 2020, 2:58pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/10 "2020-03-11T14:58:01Z")
Oh, haven't seen in detail the complete error message he was getting, I thought I had the same issue because of the same error message regarding system/socket dataset setup failed. ``` 2020-03-11T14:54:15.069+0100 INFO instance/beat.go:298 Setup Beat: auditbeat; Version: 7.6.1 2020-03-11T14:54:15.069+0100 INFO [publisher] pipeline/module.go:110 Beat name: server 2020-03-11T14:54:15.070+0100 INFO [auditd] auditd/audit_linux.go:106 auditd module is running as euid=0 on kernel=3.13.0-170-generic 2020-03-11T14:54:15.070+0100 INFO [auditd] auditd/audit_linux.go:133 socket_type=unicast will be used. 2020-03-11T14:54:15.071+0100 WARN [cfgwarn] host/host.go:167 BETA: The system/host dataset is beta 2020-03-11T14:54:15.073+0100 WARN [cfgwarn] login/login.go:95 BETA: The system/login dataset is beta 2020-03-11T14:54:15.074+0100 WARN [cfgwarn] package/package.go:170 BETA: The system/package dataset is beta 2020-03-11T14:54:15.079+0100 WARN [cfgwarn] user/user.go:205 BETA: The system/user dataset is beta 2020-03-11T14:54:15.081+0100 WARN [cfgwarn] process/process.go:131 BETA: The system/process dataset is beta 2020-03-11T14:54:15.082+0100 WARN [cfgwarn] socket/socket_linux.go:87 BETA: The system/socket dataset is beta. 2020-03-11T14:54:15.105+0100 INFO [socket] socket/socket_linux.go:223 Setting up system/socket for kernel 3.13.0-170-generic 2020-03-11T14:54:15.169+0100 INFO [socket] guess/guess.go:258 Running 17 guesses ... 2020-03-11T14:54:18.065+0100 INFO add_cloud_metadata/add_cloud_metadata.go:89 add_cloud_metadata: hosting provider type not detected. 2020-03-11T14:54:30.249+0100 INFO instance/beat.go:412 auditbeat stopped. 2020-03-11T14:54:30.251+0100 ERROR instance/beat.go:933 Exiting: 1 error: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess_inet_sock failed: timeout while waiting for event ``` My issue is more related to the guesser then : ` ERROR instance/beat.go:933 Exiting: 1 error: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess_inet_sock failed: timeout while waiting for event` ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [March 26, 2020, 5:30pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/11 "2020-03-26T17:30:38Z")
@jdelvecchio can you run in debug mode and share the logs? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 16, 2020, 5:30pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/222603/12 "2020-04-16T17:30:53Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.