# Inotify leak **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [March 25, 2024, 8:42am UTC](https://discuss.elastic.co/t/inotify-leak/356080 "2024-03-25T08:42:02Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![masonlu2014](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/masonlu2014/32/110835_2.png) [@masonlu2014](https://discuss.elastic.co/u/masonlu2014)\ **Post date:** [March 25, 2024, 8:42am UTC](https://discuss.elastic.co/t/inotify-leak/356080/1 "2024-03-25T08:42:02Z")
hello team, we found auditbeat consumer a lot inotify recently, and we are using the latest auditbeat version We find that auditbeat pods created many inotify instances \> 2000, but most of them are not used, i.e. no inotify watches. Looks that there's some inotify instances leak in the auditbeat. root@k8s-node:~# ps -ef | grep 123543 root 123543 118052 33 Mar07 ? 3-05:34:55 /usr/local/bin/auditbeat -e -v -c /etc/auditbeat/auditbeat.yml -httpprof localhost:20063 root@k8s-node:~# ls -l /proc/123543/fd/996 lr-x------ 1 root root 64 Mar 7 16:00 /proc/123543/fd/996 -\> anon\_inode:inotify root@k8s-node:~# cat /proc/123543/fdinfo/996 pos: 0 flags: 02000000 mnt\_id: 15 root@k8s-node:~# ls -l /proc/123543/fd/\* | grep inotify | wc -l 2085 root@k8s-node:~# cat /proc/123543/fdinfo/\* | grep inotify | wc -l 502 ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [March 25, 2024, 11:28am UTC](https://discuss.elastic.co/t/inotify-leak/356080/2 "2024-03-25T11:28:24Z")
Hi @masonlu2014, Have you encountered this issue in prior versions of auditbeat? Does what you're seeing look similar to [this issue](https://github.com/elastic/beats/issues/19056). ---
**Author:** ![NickFritts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickfritts/32/47189_2.png) [@NickFritts](https://discuss.elastic.co/u/NickFritts)\ **Post date:** [March 27, 2024, 10:10am UTC](https://discuss.elastic.co/t/inotify-leak/356080/3 "2024-03-27T10:10:43Z")
Hi @masonlu2014 thanks for reporting this. Could you provide some additional information - What version of auditbeat is this (latest sometimes means different things to different people and can change from day to day)? - Could you tell us what if any additional auditbeat modules you're using? - Have you configured the `backend` value in your config? if so to what? - What kernel version are you running on these hosts? ---
**Author:** ![masonlu2014](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/masonlu2014/32/110835_2.png) [@masonlu2014](https://discuss.elastic.co/u/masonlu2014)\ **Post date:** [March 28, 2024, 12:57am UTC](https://discuss.elastic.co/t/inotify-leak/356080/4 "2024-03-28T00:57:51Z")
hello Nick, we are using kernel 5.15.0-26-generic no, i think we don't conffigure any backend, ( i think default is using inofity) we are only using FIM and auditd module , nothing more sorry, i think we are using auditbeat v7. however i compare with auditbeat v7 and v8 version. the FIM module which using inoftiy monitor file change , that code is almost same here ---
**Author:** ![masonlu2014](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/masonlu2014/32/110835_2.png) [@masonlu2014](https://discuss.elastic.co/u/masonlu2014)\ **Post date:** [March 28, 2024, 12:58am UTC](https://discuss.elastic.co/t/inotify-leak/356080/5 "2024-03-28T00:58:36Z")
thanks for checking, the issue looks like simiarly. but it is almost 4 years ago ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 25, 2024, 2:59am UTC](https://discuss.elastic.co/t/inotify-leak/356080/6 "2024-04-25T02:59:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.