# Filebeat 6.0.0 spawns 3 identical processes when sudo-ed **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 22, 2018, 4:28pm UTC](https://discuss.elastic.co/t/filebeat-6-0-0-spawns-3-identical-processes-when-sudo-ed/116507 "2018-01-22T16:28:37Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Haribo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/haribo/32/26805_2.png) [@Haribo](https://discuss.elastic.co/u/Haribo)\ **Post date:** [January 22, 2018, 4:28pm UTC](https://discuss.elastic.co/t/filebeat-6-0-0-spawns-3-identical-processes-when-sudo-ed/116507/1 "2018-01-22T16:28:38Z")
Hello, I am using Filebeat to send my application logs to a remote Logstash. While testing, I ran ps -aux | grep filebeat and I noticed that starting Filebeat effectively started 3 processes : ``` $ sudo filebeat -e -c /etc/filebeat/filebeat.yml -d "publish" $ ps -aux | grep filebeat root 2789 0.0 0.3 55732 3648 pts/0 S+ 16:27 0:00 sudo filebeat -e -c /etc/filebeat/filebeat.yml -d publish root 2790 0.0 0.2 11248 2956 pts/0 S+ 16:27 0:00 /bin/bash /usr/bin/filebeat -e -c /etc/filebeat/filebeat.yml -d publish root 2791 0.0 1.8 145304 18432 pts/0 Sl+ 16:27 0:00 /usr/share/filebeat/bin/filebeat -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat -e -c /etc/filebeat/filebeat.yml -d publish ``` Is that a normal behavior ? I can't find any information about this. Regards, Haribo. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [January 22, 2018, 5:00pm UTC](https://discuss.elastic.co/t/filebeat-6-0-0-spawns-3-identical-processes-when-sudo-ed/116507/2 "2018-01-22T17:00:38Z")
Hello @Haribo, What is happening is the following, I presume you have installed Filebeat from one of the packages. When you run `sudo filebeat -e` it executes the bash script in `/usr/bin/filebeat` which spawn filebeat with the correct options to setup the environment, this will result in 2 different processes. So in your case, It is normal to have 3. The last line is a filebeat that was started from an **init script** ---
**Author:** ![Haribo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/haribo/32/26805_2.png) [@Haribo](https://discuss.elastic.co/u/Haribo)\ **Post date:** [January 23, 2018, 10:17am UTC](https://discuss.elastic.co/t/filebeat-6-0-0-spawns-3-identical-processes-when-sudo-ed/116507/3 "2018-01-23T10:17:19Z")
Thank you @pierhugues ! Do you think I should run the complete command manually to avoid having the `sudo filebeat -e` process ? ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [January 23, 2018, 1:27pm UTC](https://discuss.elastic.co/t/filebeat-6-0-0-spawns-3-identical-processes-when-sudo-ed/116507/4 "2018-01-23T13:27:29Z")
No, there is no need to run the complete command. ---
**Author:** ![Haribo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/haribo/32/26805_2.png) [@Haribo](https://discuss.elastic.co/u/Haribo)\ **Post date:** [January 23, 2018, 1:55pm UTC](https://discuss.elastic.co/t/filebeat-6-0-0-spawns-3-identical-processes-when-sudo-ed/116507/5 "2018-01-23T13:55:12Z")
Thanks for your help 😉 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 20, 2018, 1:55pm UTC](https://discuss.elastic.co/t/filebeat-6-0-0-spawns-3-identical-processes-when-sudo-ed/116507/6 "2018-02-20T13:55:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.