# Limit CPU/Memory usage in Auditbeat & Filebeats , version 7.9.0
**URL:** https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231
**Category:** SIEM
**Created:** [September 10, 2020, 8:06pm UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231 "2020-09-10T20:06:34Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@ajesh](https://discuss.elastic.co/u/ajesh)
#### Post date: [September 10, 2020, 8:06pm UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231/1 "2020-09-10T20:06:34Z")
Hi Team,
We are seeing that auditbeat service is using lot of memory in our VM's , we suspect that when elasticsearch cluster is down its taking more memory in auditbeat to buffer the data. Could you please let me know if we can do some update in auditbeat.yml so that it will not buffer any data in memory
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
20849 root 20 0 27.4g 24.6g 38784 S 71.4 44.1 683:48.32 auditbeat
---
### Author:  [@ajesh](https://discuss.elastic.co/u/ajesh)
#### Post date: [September 14, 2020, 6:43pm UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231/2 "2020-09-14T18:43:43Z")
Hello Team,
Kindly look into this issue. We are seeing this issue on multiple servers even if the elasticsearch cluster is UP.
One option we tried is disabled socket and process module and we could see the cpu/memory usage has considerably decreased and still monitoring. But would like to know if there is any thing more we can do to resolve this issue.
Please help
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [September 14, 2020, 9:00pm UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231/3 "2020-09-14T21:00:52Z")
(Moving to SIEM category so the Elastic team that handles Auditbeat sees this post).
---
### Author:  [@PublicName](https://discuss.elastic.co/u/PublicName)
#### Post date: [September 16, 2020, 4:32pm UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231/4 "2020-09-16T16:32:20Z")
2nd the request. This also plays in with the ones pre packages with the ingest manager. As an idea of a cap 512Mb to 1Gb max should be all that they use with no more then 50% CPU. I had metricbeat take a few of my servers as it took 6Gb+ ram from the host and it starved out the application.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 16, 2020, 9:09pm UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231/5 "2020-09-16T21:09:22Z")
> [@ajesh](#):
>
> Could you please let me know if we can do some update in auditbeat.yml so that it will not buffer any data in memory
You can minimize this by changing the settings for the internal queue. See the details at [Configure the internal queue | Auditbeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/current/configuring-internal-queue.html). As an example:
```auto
queue.mem:
flush.min_events: 512
events: 1024
```
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 16, 2020, 9:25pm UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231/6 "2020-09-16T21:25:02Z")
If you are still seeing conditions when Auditbeat consumes lots of memory you can take a heap profile while it's running that can be used to identify what's consuming the space. To prepare you need to have Auditbeat running with the added CLI flag of `--httpprof localhost:8080`.
Then when you want to capture a heap profile you can use `curl` to save it.
`curl -O heap1.prof http://localhost:8080/debug/pprof/heap`
That file can be analyzed with `go tool pprof -http=localhost:6060 heap1.prof` ([https://github.com/google/pprof#run-pprof-via-a-web-interface](https://github.com/google/pprof#run-pprof-via-a-web-interface)). This can help show what objects are consuming the space and where they are allocated.
---
### Author:  [@ajesh](https://discuss.elastic.co/u/ajesh)
#### Post date: [September 17, 2020, 7:49am UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231/7 "2020-09-17T07:49:11Z")
Thanks Andrew. As of now its fine after disabling socket and process datasets. also we have added this new config as you suggested.
queue.mem:
flush.min\_events: 16
events: 32
I ill try to capture the heap profile for further analysis. Hope this heap profile capture works for filebeat as well.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 17, 2020, 1:23pm UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231/8 "2020-09-17T13:23:10Z")
> [@ajesh](#):
>
> I ill try to capture the heap profile for further analysis. Hope this heap profile capture works for filebeat as well.
It will work for any Beat. Additionally it can be used to collect 30 second CPU profiles if you read from `/debug/pprof/profile`.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 15, 2020, 3:23pm UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231/9 "2020-10-15T15:23:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.