# Monitoring new users on Linux with Auditbeat
**URL:** https://discuss.elastic.co/t/monitoring-new-users-on-linux-with-auditbeat/348647
**Category:** Beats
**Tags:** auditbeat
**Created:** [December 5, 2023, 2:01pm UTC](https://discuss.elastic.co/t/monitoring-new-users-on-linux-with-auditbeat/348647 "2023-12-05T14:01:06Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@DominikStejskal](https://discuss.elastic.co/u/DominikStejskal)
#### Post date: [December 5, 2023, 2:01pm UTC](https://discuss.elastic.co/t/monitoring-new-users-on-linux-with-auditbeat/348647/1 "2023-12-05T14:01:06Z")
Hello,
we are trying to monitor the creation of new user accounts on Linux machines with Auditbeat (7.17). We would like to know the names of the newly created users. Creating a new user shows up in Kibana as an event from `event.module : auditd`, with `event.action : added_user_account` and containing the `user.target.id` field. But despite `resolve_ids: true` being explicitly stated in the `auditbeat.yml` configuration file, there is no `user.target.name` field. How could we fix that?
Furthermore, from some machines, we also get an event from `event.module : system` with `event.action : user_added` (which contains the `user.name` of the new user), but from others we don't. Why could that be?
---
### Author:  [@DominikStejskal](https://discuss.elastic.co/u/DominikStejskal)
#### Post date: [December 19, 2023, 9:42am UTC](https://discuss.elastic.co/t/monitoring-new-users-on-linux-with-auditbeat/348647/2 "2023-12-19T09:42:45Z")
Is there perhaps some other way to monitor the names of newly added users?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2024, 11:43am UTC](https://discuss.elastic.co/t/monitoring-new-users-on-linux-with-auditbeat/348647/3 "2024-01-16T11:43:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.