# FIM module in auditbeat keeps too many file handles open on Kubrenetes

**URL:** <https://discuss.elastic.co/t/fim-module-in-auditbeat-keeps-too-many-file-handles-open-on-kubrenetes/236239>\
**Category:** SIEM\
**Created:** [June 8, 2020, 10:20pm UTC](https://discuss.elastic.co/t/fim-module-in-auditbeat-keeps-too-many-file-handles-open-on-kubrenetes/236239 "2020-06-08T22:20:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![premendra2020singh](https://avatars.discourse-cdn.com/v4/letter/p/df705f/32.png) [@premendra2020singh](https://discuss.elastic.co/u/premendra2020singh)\
**Post date:** [June 8, 2020, 10:20pm UTC](https://discuss.elastic.co/t/fim-module-in-auditbeat-keeps-too-many-file-handles-open-on-kubrenetes/236239/1 "2020-06-08T22:20:32Z")

</div>

I'm using Auditbeat with FIM module on Kubernetes daemonset with 40 pods on it.

Auditbeat version - latest  
OS - Debian GNU/Linux 9  
ulimit -n 1048576  
Auditbeat pod memory allocation - 200mb

Open file handles go up to 2700 over 9 hours, then auditbeat pod gets OOMKilled and restarts.  
Any suggestions how to close file handles.

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [June 8, 2020, 11:12pm UTC](https://discuss.elastic.co/t/fim-module-in-auditbeat-keeps-too-many-file-handles-open-on-kubrenetes/236239/2 "2020-06-08T23:12:19Z")

</div>

(Moving to SIEM category where this should get 👀 from the right developers/community).

---

<div class="post-metadata">

**Author:** ![nwed](https://avatars.discourse-cdn.com/v4/letter/n/dbc845/32.png) [@nwed](https://discuss.elastic.co/u/nwed)\
**Post date:** [June 8, 2020, 11:31pm UTC](https://discuss.elastic.co/t/fim-module-in-auditbeat-keeps-too-many-file-handles-open-on-kubrenetes/236239/3 "2020-06-08T23:31:16Z")

</div>

We are trying to monitor the integrity of files within the container.. This is why the file handles can grow quickly. This is a large enhancement for us, hoping there is a way we can better control file handles open.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2020, 1:31am UTC](https://discuss.elastic.co/t/fim-module-in-auditbeat-keeps-too-many-file-handles-open-on-kubrenetes/236239/4 "2020-07-07T01:31:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.