# Metricset system: users and service

**URL:** <https://discuss.elastic.co/t/metricset-system-users-and-service/301093>\
**Category:** Beats\
**Tags:** beats-module, metricbeat\
**Created:** [March 30, 2022, 1:14pm UTC](https://discuss.elastic.co/t/metricset-system-users-and-service/301093 "2022-03-30T13:14:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rdinis](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@rdinis](https://discuss.elastic.co/u/rdinis)\
**Post date:** [March 30, 2022, 1:14pm UTC](https://discuss.elastic.co/t/metricset-system-users-and-service/301093/1 "2022-03-30T13:14:53Z")

</div>

Hi,  
I'm running metricbeat on container and i have found this error:

```auto
{"level":"error","timestamp":"2022-03-27T16:12:45.481Z","logger":"reload","caller":"cfgfile/list.go:99","message":"Error creating runner from config: 2 errors: error connecting to dbus: read unix @->/run/systemd/private: read: connection reset by peer; error connecting to dbus: error authenticating: dbus: authentication failed"}

```

I have found out that only 2 metricsets generate this error: [Users](https://www.elastic.co/guide/en/beats/metricbeat/8.1/metricbeat-metricset-system-users.html) and [Service](https://www.elastic.co/guide/en/beats/metricbeat/8.1/metricbeat-metricset-system-service.html).  
In this guide [System users metricset](https://www.elastic.co/guide/en/beats/metricbeat/8.1/metricbeat-metricset-system-users.html) it's recommended to:

> By default, the metricset will look in `/var/run/dbus/` for a system socket, although a new path can be selected with `DBUS_SYSTEM_BUS_ADDRESS` .

Is there any recommendation how to do it? Or a simple guide to follow?  
I'm using centos7 and the running command of the container has this volumes:

- --volume="/var/run/dbus/system\_bus\_socket:/var/run/dbus/system\_bus\_socket"
- --volume="/run/systemd/private:/run/systemd/private:ro"
- --volume="/var/run/dbus/:/var/run/dbus/"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2022, 3:15pm UTC](https://discuss.elastic.co/t/metricset-system-users-and-service/301093/2 "2022-04-27T15:15:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.