# Missing network traffic from metricbeat on mac OS

**URL:** <https://discuss.elastic.co/t/missing-network-traffic-from-metricbeat-on-mac-os/217642>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [February 3, 2020, 3:07pm UTC](https://discuss.elastic.co/t/missing-network-traffic-from-metricbeat-on-mac-os/217642 "2020-02-03T15:07:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aviationfan](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@aviationfan](https://discuss.elastic.co/u/aviationfan)\
**Post date:** [February 3, 2020, 3:07pm UTC](https://discuss.elastic.co/t/missing-network-traffic-from-metricbeat-on-mac-os/217642/1 "2020-02-03T15:07:05Z")

</div>

I am investigating an issue where one of my macs is reporting network traffic and the other is not.

Both macs have High Sierra macOS 10.13.6 (17G11023). I include the build number because that changed last week when apple pushed out security update 2020-001 and a bunch of things changed. Could this be a file permissions problem? Is it a missing tool that metric beat would use?

The system.yml file on each machine are identical, as are the metricbeat.yml files

```auto
cat /usr/local/etc/metricbeat/modules.d/system.yml 
# Module: system
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.5/metricbeat-module-system.html

- module: system
  period: 10s
  metricsets:
    - cpu
    - load
    - memory
    - network
    - process
    - process_summary
    - socket_summary
    #- entropy
    #- core
    - diskio
    #- socket
  process.include_top_n:
    by_cpu: 5 # include top 5 processes by CPU
    by_memory: 5 # include top 5 processes by memory

- module: system
  period: 1m
  metricsets:
    - filesystem
    - fsstat
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'

- module: system
  period: 15m
  metricsets:
    - uptime

#- module: system
# period: 5m
# metricsets:
# - raid
# raid.mount_point: '/'

```

The service is run under my user id on both machines.

```auto
macpro2:~ jjwelch$ brew services list
Name Status User Plist
metricbeat-full started <local admin> /usr/local/opt/metricbeat-full/homebrew.mxcl.metricbeat-full.plist

```

Digging into the metrics themselves reveal the data IS in elastic so maybe a problem with the dashboard?

---

<div class="post-metadata">

**Author:** ![Alex\_Kristiansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_kristiansen/32/46086_2.png) [@Alex\_Kristiansen](https://discuss.elastic.co/u/Alex_Kristiansen)\
**Post date:** [February 5, 2020, 3:28pm UTC](https://discuss.elastic.co/t/missing-network-traffic-from-metricbeat-on-mac-os/217642/2 "2020-02-05T15:28:37Z")

</div>

@aviationfan,

If both macs are running the same version of MacOS, it's unlikely to be a dashboard issue. Are the events being sent by the bad node complete? Can you turn on debug logging and check for any permissions/event errors?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 4, 2020, 3:28pm UTC](https://discuss.elastic.co/t/missing-network-traffic-from-metricbeat-on-mac-os/217642/3 "2020-03-04T15:28:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.