Issues with starting Filebeat 7.9.1

Having issues starting filebeat installed in RHEL8 . Error is related to kibana wanting permissions. Output error is below:

Last login: Tue Apr 27 14:39:31 2021 from 10.147.4.244
# ausearch -c 'filebeat' --raw | audit2allow -M my-filebeat
# semodule -X 300 -i my-filebeat.pp

May 03 16:51:51 fdslv25003 setroubleshoot[500834]: AnalyzeThread.run(): Set alarm timeout to 10
May 03 16:52:07 fdslv25003 sedispatch[1111]: AVC Message for setroubleshoot, dropping message
May 03 16:52:19 fdslv25003 sedispatch[1111]: AVC Message for setroubleshoot, dropping message
May 03 16:54:03 fdslv25003 subscription-manager[501002]: Added subscription for 'Content Access' contract 'None'
May 03 16:54:03 fdslv25003 subscription-manager[501002]: Added subscription for product ' Content Access'
May 03 16:54:09 fdslv25003 crontab[501033]: (root) LIST (root)
May 03 16:54:09 fdslv25003 puppet-agent[500910]: Applied catalog in 8.78 seconds
May 03 16:54:34 fdslv25003 systemd[1]: Starting LSB: Runs filebeat daemon...
-- Subject: Unit filebeat.service has begun start-up
-- Defined-By: systemd
-- Support: Red Hat Customer Experience & Engagement - Red Hat Customer Portal

-- Unit filebeat.service has begun starting up.
May 03 16:54:34 fdslv25003 filebeat[501061]: Starting Filebeat : USER=jboss
May 03 16:54:34 fdslv25003 filebeat[501061]: PID_FILE=/var/run/filebeat/filebeat.pid
May 03 16:54:34 fdslv25003 filebeat[501061]: DAEMON=/u0/CTP_NG/apps/filebeat/current/filebeat
May 03 16:54:34 fdslv25003 filebeat[501061]: LOG=/u0/CTP_NG/apps/filebeat/logs/filebeat.log
May 03 16:54:34 fdslv25003 dbus-daemon[1164]: [system] Activating service name='org.fedoraproject.Setroubleshootd' requested by ':1.7' (uid=0 pid=1111 comm="/usr/sbin/sedispatch " label="s>
May 03 16:54:34 fdslv25003 runuser[501074]: pam_unix(runuser:session): session opened for user jboss by (uid=0)
May 03 16:54:34 fdslv25003 dbus-daemon[501078]: [system] Failed to reset fd limit before activating service: org.freedesktop.DBus.Error.AccessDenied: Failed to restore old fd limit: Operat>
May 03 16:54:34 fdslv25003 runuser[501074]: pam_unix(runuser:session): session closed for user jboss
May 03 16:54:35 fdslv25003 dbus-daemon[1164]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
May 03 16:54:36 fdslv25003 filebeat[501061]: [ OK ]
May 03 16:54:36 fdslv25003 systemd[1]: filebeat.service: Control process exited, code=exited status=3
May 03 16:54:36 fdslv25003 systemd[1]: filebeat.service: Failed with result 'exit-code'.
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: Red Hat Customer Experience & Engagement - Red Hat Customer Portal

-- The unit filebeat.service has entered the 'failed' state with result 'exit-code'.
May 03 16:54:36 fdslv25003 systemd[1]: Failed to start LSB: Runs filebeat daemon.
-- Subject: Unit filebeat.service has failed
-- Defined-By: systemd
-- Support: Red Hat Customer Experience & Engagement - Red Hat Customer Portal

-- Unit filebeat.service has failed.

-- The result is failed.
May 03 16:54:36 fdslv25003 setroubleshoot[501078]: AnalyzeThread.run(): Cancel pending alarm
May 03 16:54:36 fdslv25003 sedispatch[1111]: AVC Message for setroubleshoot, dropping message
May 03 16:54:36 fdslv25003 sedispatch[1111]: AVC Message for setroubleshoot, dropping message
May 03 16:54:36 fdslv25003 sedispatch[1111]: AVC Message for setroubleshoot, dropping message
May 03 16:54:36 fdslv25003 setroubleshoot[501078]: failed to retrieve rpm info for /u0/CTP_NG/apps/filebeat/logs/filebeat.log
Finishing logfile... (interrupt to abort)

Welcome to our community! :smiley:

Please format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you :slight_smile:

I can't see anything in there about Kibana. Can you check /var/log/filebeat/ for any other logs?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.