# Is AuditBeat dependent on Auditd daemon?

**URL:** <https://discuss.elastic.co/t/is-auditbeat-dependent-on-auditd-daemon/201503>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [September 28, 2019, 6:29pm UTC](https://discuss.elastic.co/t/is-auditbeat-dependent-on-auditd-daemon/201503 "2019-09-28T18:29:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Suat\_Bey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suat_bey/32/46322_2.png) [@Suat\_Bey](https://discuss.elastic.co/u/Suat_Bey)\
**Post date:** [September 28, 2019, 6:29pm UTC](https://discuss.elastic.co/t/is-auditbeat-dependent-on-auditd-daemon/201503/1 "2019-09-28T18:29:30Z")

</div>

Do we need to install and start auditd in order to user AuditBeat? Or just installation AuditBeat will do the auditing , logging without auditd daemon? On last question is there any functşon that auditd can do but, AuditBeat can't do?

regards

---

<div class="post-metadata">

**Author:** ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)\
**Post date:** [October 1, 2019, 8:33pm UTC](https://discuss.elastic.co/t/is-auditbeat-dependent-on-auditd-daemon/201503/2 "2019-10-01T20:33:45Z")

</div>

The following page is a good description of the description between auditd and auditbeat.

> **[Auditbeat: Lightweight Shipper for Audit Data](https://www.elastic.co/beats/auditbeat)**
>
> Collect and ship Linux audit framework data to the Elastic Stack, parse and normalize messages, and monitor the integrity of your files in real time.

> Auditbeat communicates directly with the Linux audit framework, collects the same data as auditd, and sends the events to the Elastic Stack in real time. If you’re feeling nostalgic, you can run auditd alongside Auditbeat (in newer kernels).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2019, 8:33pm UTC](https://discuss.elastic.co/t/is-auditbeat-dependent-on-auditd-daemon/201503/3 "2019-10-22T20:33:49Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.