# FIM integration User data missing

**URL:** <https://discuss.elastic.co/t/fim-integration-user-data-missing/374170>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [February 6, 2025, 9:33am UTC](https://discuss.elastic.co/t/fim-integration-user-data-missing/374170 "2025-02-06T09:33:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amarasinghe.kaluarac](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\
**Post date:** [February 6, 2025, 9:33am UTC](https://discuss.elastic.co/t/fim-integration-user-data-missing/374170/1 "2025-02-06T09:33:01Z")

</div>

Hi all,

I have configured the File Integrity Monitoring Integration for my Linux server but even though the logs being ingested to my Elasticsearch some fileds like Process.user.name is missing from logs , This process fileds indicates who did th echanges to what but my logs are missing of these informations.

can anyone help me with this

---

<div class="post-metadata">

**Author:** ![amarasinghe.kaluarac](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\
**Post date:** [February 6, 2025, 9:35am UTC](https://discuss.elastic.co/t/fim-integration-user-data-missing/374170/2 "2025-02-06T09:35:15Z")

</div>

Hi ,  
So while troubleshooting I tried this integration on my testing server but now everything works on my testing server but the issue still proceed on my other server , I tried with File Event Source setting to auto and ebpf but still I am not getting those process fileds

---

<div class="post-metadata">

**Author:** ![Alex\_Kristiansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_kristiansen/32/46086_2.png) [@Alex\_Kristiansen](https://discuss.elastic.co/u/Alex_Kristiansen)\
**Post date:** [February 7, 2025, 3:58pm UTC](https://discuss.elastic.co/t/fim-integration-user-data-missing/374170/3 "2025-02-07T15:58:59Z")

</div>

@amarasinghe.kaluarac can you provide the kernel version/OS of your machine? Are there any error messages in the logs?

---

<div class="post-metadata">

**Author:** ![amarasinghe.kaluarac](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\
**Post date:** [February 10, 2025, 4:21am UTC](https://discuss.elastic.co/t/fim-integration-user-data-missing/374170/4 "2025-02-10T04:21:50Z")

</div>

Hi Alex,

After testing the integration, I set the File Event Source to eBPF and encountered the following error in the logs:

\<\< failed to start event producer: init ebpf loader: check kernel version: min kernel version (5.10.16) is higher or equal than current kernel version (4.4.262) \>\>

Upon checking, I found that my Linux version is 4.4.0-210-generic. Could this be the cause of the issue?

---

<div class="post-metadata">

**Author:** ![Alex\_Kristiansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_kristiansen/32/46086_2.png) [@Alex\_Kristiansen](https://discuss.elastic.co/u/Alex_Kristiansen)\
**Post date:** [February 10, 2025, 4:10pm UTC](https://discuss.elastic.co/t/fim-integration-user-data-missing/374170/5 "2025-02-10T16:10:31Z")

</div>

Yes, the kernel is too old in this case.