# Exiting: data path already locked by another beat (packetbeat)

**URL:** <https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-packetbeat/238368>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [June 24, 2020, 3:29am UTC](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-packetbeat/238368 "2020-06-24T03:29:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [June 24, 2020, 3:29am UTC](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-packetbeat/238368/1 "2020-06-24T03:29:31Z")

</div>

Hello  
Just installed and configured packetbeat (7.6.2) on the elastic server (7.6.2).  
filebeat and metricbeat also run on the same server(s), and of course elasticsearch.  
packetbeat is not sending any data, so I wanted to debug.  
when trying to debug with

```auto
packetbeat -e

```

Getting the following messages

```auto
[root@ELSSERVER packetbeat]# packetbeat -e
2020-06-24T13:11:23.176+1000 INFO instance/beat.go:622 Home path: [/usr/share/packetbeat] Config path: [/etc/packetbeat] Data path: [/var/lib/packetbeat] Logs path: [/var/log/packetbeat]
2020-06-24T13:11:23.176+1000 INFO instance/beat.go:630 Beat ID: 410ec1f1-81ae-4363-b9b3-05aad70ffed9
2020-06-24T13:11:23.181+1000 INFO instance/beat.go:380 packetbeat stopped.
2020-06-24T13:11:23.181+1000 ERROR instance/beat.go:933 Exiting: data path already locked by another beat
Exiting: data path already locked by another beat

```

I searched the forum and generally the net, and could not find a solution.

packetbeat.yml --\>

```auto
- type: http
  # Configure the ports where to listen for HTTP traffic. You can disable
  # the HTTP protocol by commenting out the list of ports.
  ports: [80, 8080, 8000, 5000, 8002, 9200]
  send_request: true   
  include_body_for: ["application/json", "x-www-form-urlencoded"]

- type: tls
  # Configure the ports where to listen for TLS traffic. You can disable
  # the TLS protocol by commenting out the list of ports.
  ports:
    - 443 # HTTPS
    - 993 # IMAPS
    - 995 # POP3S
    - 5223 # XMPP over SSL
    - 8443
    - 8883 # Secure MQTT
    - 9243 # Elasticsearch

output.logstash:
  # The Logstash hosts
  hosts: ["IP:5144"]

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~

```

What is missing/wrong?

Thanks!

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [June 24, 2020, 6:08am UTC](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-packetbeat/238368/2 "2020-06-24T06:08:03Z")

</div>

Could you please make sure that there is no other instance of packetbeat running (via list of active processes)? AFAIK there is also a command line arg to specify the `data.path`

---

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [June 24, 2020, 6:21am UTC](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-packetbeat/238368/3 "2020-06-24T06:21:36Z")

</div>

Cannot see there are 2 running services.

Running

```auto
systemctl list-units --type=service --state=active

```

Gives me the following result.  
Not sure if duplicate services will show twice.

 ![2020-06-24 16_18_38-Window](https://us1.discourse-cdn.com/elastic/original/3X/6/5/6550d9d70a72ae13fcc149b7979347be02d9af6b.png)

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [June 24, 2020, 9:07am UTC](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-packetbeat/238368/4 "2020-06-24T09:07:32Z")

</div>

How about system processes? Maybe there is a zombie instance.

---

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [June 25, 2020, 3:40am UTC](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-packetbeat/238368/5 "2020-06-25T03:40:48Z")

</div>

I dont think so.  
But it is working now.  
Not sure the root cause

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2020, 5:40am UTC](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-packetbeat/238368/6 "2020-07-23T05:40:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.