# Operation not permitted \<= New Beat
**URL:** https://discuss.elastic.co/t/operation-not-permitted-new-beat/147459
**Category:** Beats
**Tags:** beats-development
**Created:** [September 5, 2018, 6:33pm UTC](https://discuss.elastic.co/t/operation-not-permitted-new-beat/147459 "2018-09-05T18:33:38Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@kmacew](https://discuss.elastic.co/u/kmacew)
#### Post date: [September 5, 2018, 6:33pm UTC](https://discuss.elastic.co/t/operation-not-permitted-new-beat/147459/1 "2018-09-05T18:33:39Z")
Hi
I followed tutorial how to create new beat ([https://www.elastic.co/guide/en/beats/devguide/current/new-beat.html](https://www.elastic.co/guide/en/beats/devguide/current/new-beat.html)). With tutorial I didn't have much problems. Since trying to add some logic to new beat I encountered something strange. I wanted to execute command within Run function inside beater/xxx.go. I added following to xxx.go:
import (
[...]
"os/exec"
[...]
)
Under the:
func (bt \*xxx) Run(b \*beat.Beat) error {
[...]
command := exec.Command("python", "path/py.py")
[...] }
I always receive error:
fork/exec /usr/bin/python: operation not permitted
I've got ubuntu 18.04, virtualenv 15.1.0 and go version: go 1.10.3 linux/amd64
Looking forward to hearing from you
Regards,
KM
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 5, 2018, 7:10pm UTC](https://discuss.elastic.co/t/operation-not-permitted-new-beat/147459/2 "2018-09-05T19:10:53Z")
The simplest solution IMO would be to disable the seccomp protections provided by libbeat that prohibit the beat from executing anything. You can add
`seccomp.enabed: false`
to your config file or add
`-E seccomp.enabled=false`
to your CLI args.
You can read more about the seccomp feature in any one of the Beat's documentation. [https://www.elastic.co/guide/en/beats/metricbeat/6.4/linux-seccomp.html](https://www.elastic.co/guide/en/beats/metricbeat/6.4/linux-seccomp.html)
And there is more developer level info in the readme at [https://github.com/elastic/beats/tree/master/libbeat/common/seccomp](https://github.com/elastic/beats/tree/master/libbeat/common/seccomp).
---
### Author:  [@kmacew](https://discuss.elastic.co/u/kmacew)
#### Post date: [September 6, 2018, 5:38pm UTC](https://discuss.elastic.co/t/operation-not-permitted-new-beat/147459/3 "2018-09-06T17:38:19Z")
Hi Andrew
Thanks for replying, I'll try it out in few days and let you know how it went.
Regards,
KM
---
### Author:  [@kmacew](https://discuss.elastic.co/u/kmacew)
#### Post date: [September 7, 2018, 5:11pm UTC](https://discuss.elastic.co/t/operation-not-permitted-new-beat/147459/4 "2018-09-07T17:11:04Z")
Hi
Andrew i've tried both methods. One worked, another didn't. With flag `-E seccomp.enabled=false` It worked like a charm. With `seccomp.enabled: false` in configuration file It didn't. I suppose I made this overwrite in wrong configuration file. I added `seccomp.enabled: false` to \_meta/beat.yml like:
################### xxx Configuration Example #########################
############################# xxx ######################################
xxx:
period: 1s
seccomp.enabled: false
Thanks you very much for helping me out.
Regards,
KM
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 7, 2018, 5:48pm UTC](https://discuss.elastic.co/t/operation-not-permitted-new-beat/147459/5 "2018-09-07T17:48:24Z")
You would want to add `seccomp.enabled: false` to the configuration file that you are loading into your Beat. That is the file specified with `-c beatname.yml` on the CLI.
---
### Author:  [@kmacew](https://discuss.elastic.co/u/kmacew)
#### Post date: [September 7, 2018, 6:46pm UTC](https://discuss.elastic.co/t/operation-not-permitted-new-beat/147459/6 "2018-09-07T18:46:04Z")
You're right. It worked.
Thank you very much and wish you the best,
KM
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 5, 2018, 8:46pm UTC](https://discuss.elastic.co/t/operation-not-permitted-new-beat/147459/7 "2018-10-05T20:46:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.