# Failed to hash executable /usr/sbin/agetty

**URL:** <https://discuss.elastic.co/t/failed-to-hash-executable-usr-sbin-agetty/228283>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [April 16, 2020, 8:55am UTC](https://discuss.elastic.co/t/failed-to-hash-executable-usr-sbin-agetty/228283 "2020-04-16T08:55:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![StefanDE](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@StefanDE](https://discuss.elastic.co/u/StefanDE)\
**Post date:** [April 16, 2020, 8:55am UTC](https://discuss.elastic.co/t/failed-to-hash-executable-usr-sbin-agetty/228283/1 "2020-04-16T08:55:17Z")

</div>

On RHEL when starting auditbeat I get this errormessage via journalctl -u auditbeat:

> ```
> WARN [process] process/process.go:234 failed to hash executable /usr/sbin/agetty;5e46b406 (deleted) for PID 1140: failed to stat file /usr/sbin/agetty;5e46b406 (deleted): stat /usr/sbin/agetty;5e46b406 (deleted): no such file or directory
> 
> ```

Result is that SIEM module does not detect when I e.g. use "whoami" in bash.

cat /usr/sbin/agetty gives me letters...so it exists.  
\*edit: but...

> ps -ef|grep tty  
> root 1140 1 0 2019 tty1 00:00:00 /sbin/agetty --noclear tty1 linux

so do I need to change some config from /usr/sbin/agetty to /sbin/agetty ?

I don't find "agetty" in auditbeat.yml. Where would I change this?

---

<div class="post-metadata">

**Author:** ![StefanDE](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@StefanDE](https://discuss.elastic.co/u/StefanDE)\
**Post date:** [April 20, 2020, 7:51am UTC](https://discuss.elastic.co/t/failed-to-hash-executable-usr-sbin-agetty/228283/2 "2020-04-20T07:51:35Z")

</div>

in the meantime I've learned, that the warning "failed to hash executable /usr/sbin/agetty" is not the source of my problem.

I had to remove the comment before some of the lines in auditbeat.yml in the - "module: auditd" section.

Never thought about that as on Windows the whoami-alert was running from the start.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2020, 7:51am UTC](https://discuss.elastic.co/t/failed-to-hash-executable-usr-sbin-agetty/228283/3 "2020-05-11T07:51:39Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.