# Error: system/socket dataset setup failed

**URL:** <https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/329761>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [April 11, 2023, 3:33pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/329761 "2023-04-11T15:33:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![med\_dp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/med_dp/32/101420_2.png) [@med\_dp](https://discuss.elastic.co/u/med_dp)\
**Post date:** [April 11, 2023, 3:33pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/329761/1 "2023-04-11T15:33:29Z")

</div>

Hello all

I have this issus with auditeat, any help please

```auto
Apr 11 01:08:47 wnl03 auditbeat[13640]: 2023-04-11T01:08:47.574+0200 ERROR instance/beat.go:989 Exiting: 1 error: system/socket dataset setup failed: unable to
Apr 11 01:08:47 wnl03 auditbeat[13640]: Exiting: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess_struct_creds failed: timeout wh
Apr 11 01:08:47 wnl03 systemd[1]: auditbeat.service: main process exited, code=exited, status=1/FAILURE
Apr 11 01:08:47 wnl03 systemd[1]: Unit auditbeat.service entered failed state.
Apr 11 01:08:47 wnl03 systemd[1]: auditbeat.service failed.
Apr 11 01:08:47 wnl03 systemd[1]: auditbeat.service holdoff time over, scheduling restart.
Apr 11 01:08:47 wnl03 systemd[1]: Stopped Audit the activities of users and processes on your system..
Apr 11 01:08:47 wnl03 systemd[1]: Started Audit the activities of users and processes on your system..
Apr 11 01:09:03 wnl03 auditbeat[13688]: 2023-04-11T01:09:03.095+0200 ERROR instance/beat.go:989 Exiting: 1 error: system/socket dataset setup failed: unable to
Apr 11 01:09:03 wnl03 auditbeat[13688]: Exiting: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess_sk_buff_proto failed: timeout w
Apr 11 01:09:03 wnl03 systemd[1]: auditbeat.service: main process exited, code=exited, status=1/FAILURE
Apr 11 01:09:03 wnl03 systemd[1]: Unit auditbeat.service entered failed state.
Apr 11 01:09:03 wnl03 systemd[1]: auditbeat.service failed.
Apr 11 01:08:47 wnldft1odb01.webhelp.nl systemd[1]: Unit auditbeat.service entered failed state.
Apr 11 01:08:47 wnldft1odb01.webhelp.nl systemd[1]: auditbeat.service failed.
Apr 11 01:08:47 wnldft1odb01.webhelp.nl systemd[1]: auditbeat.service holdoff time over, scheduling restart.
Apr 11 01:08:47 wnldft1odb01.webhelp.nl systemd[1]: Stopped Audit the activities of users and processes on your system..
Apr 11 01:08:47 wnldft1odb01.webhelp.nl systemd[1]: Started Audit the activities of users and processes on your system..
Apr 11 01:09:03 wnldft1odb01.webhelp.nl auditbeat[13688]: 2023-04-11T01:09:03.095+0200 ERROR instance/beat.go:989 Exiting: 1 error: system/socket dataset setup failed: unable to
Apr 11 01:09:03 wnldft1odb01.webhelp.nl auditbeat[13688]: Exiting: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess_sk_buff_proto failed: timeout w
Apr 11 01:09:03 wnldft1odb01.webhelp.nl systemd[1]: auditbeat.service: main process exited, code=exited, status=1/FAILURE
Apr 11 01:09:03 wnldft1odb01.webhelp.nl systemd[1]: Unit auditbeat.service entered failed state.
Apr 11 01:09:03 wnldft1odb01.webhelp.nl systemd[1]: auditbeat.service failed.

```

Thanks;

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2023, 5:33pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/329761/2 "2023-05-09T17:33:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.