# Packetbeat deployed using ECK crashes

**URL:** <https://discuss.elastic.co/t/packetbeat-deployed-using-eck-crashes/274791>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Created:** [June 2, 2021, 6:22pm UTC](https://discuss.elastic.co/t/packetbeat-deployed-using-eck-crashes/274791 "2021-06-02T18:22:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ahmad\_Al-Masry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmad_al-masry/32/65270_2.png) [@Ahmad\_Al-Masry](https://discuss.elastic.co/u/Ahmad_Al-Masry)\
**Post date:** [June 2, 2021, 6:22pm UTC](https://discuss.elastic.co/t/packetbeat-deployed-using-eck-crashes/274791/1 "2021-06-02T18:22:57Z")

</div>

I have started elastic 7.13 cluster using ECK 1.6.0, packetbeat pods keep crashing with the following error:

> ERROR instance/beat.go:989 Exiting: sniffer loop failed: Sniffing error: Read Error  
> Exiting: sniffer loop failed: Sniffing error: Read Error

This is hosted using Amazon EKS 1.20.4 and the OS is bottlerocket 1.1.1

```auto
    apiVersion: beat.k8s.elastic.co/v1beta1
    kind: Beat
    metadata:
      name: elastic-pb
      namespace: elasticsearch
    spec:
      type: packetbeat
      version: 7.13.0
      elasticsearchRef:
        name: elastic
      kibanaRef:
        name: elastic
      config:
        logging.level: warning
        monitoring.enabled: true
        packetbeat:
          flows.enabled: false
          interfaces.device: any
          protocols:
          - type: dns
            ports: [53]
            include_authorities: true
            include_additionals: true
          - type: http
            ports: [80, 8080]
          - type: tls
            ports: [443, 8443]
          - type: mysql
            ports: [3306]
          - type: pgsql
            ports: [5432]
          - type: redis
            ports: [6379]
        processors:
        - add_cloud_metadata: {}
        - add_host_metadata: {}
        - add_kubernetes_metadata:
            host: ${HOSTNAME}
            indexers:
            - ip_port:
            matchers:
            - field_format:
                format: '%{[ip]}:%{[port]}'
      daemonSet:
        podTemplate:
          spec:
            serviceAccountName: packetbeat
            automountServiceAccountToken: true
            terminationGracePeriodSeconds: 30
            dnsPolicy: ClusterFirstWithHostNet
            hostNetwork: true # Allows to provide richer host metadata
            containers:
            - name: packetbeat
              resources:
                limits:
                  memory: 300Mi
                requests:
                  cpu: 100m
                  memory: 200Mi
              securityContext:
                runAsUser: 0
                capabilities:
                  add:
                    - NET_ADMIN
              volumeMounts:
              - name: data
                mountPath: /usr/share/packetbeat/data
            volumes:
            - name: data
              hostPath:
                path: /var/lib/packetbeat-data
                type: DirectoryOrCreate
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: packetbeat
    rules:
    - apiGroups: [""] # "" indicates the core API group
      resources:
      - namespaces
      - services
      - pods
      - nodes
      verbs:
      - get
      - watch
      - list
    - apiGroups: ["apps"]
      resources:
        - replicasets
      verbs: ["get", "list", "watch"]
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: packetbeat
      namespace: elasticsearch
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: packetbeat
    subjects:
    - kind: ServiceAccount
      name: packetbeat
      namespace: elasticsearch
    roleRef:
      kind: ClusterRole
      name: packetbeat
      apiGroup: rbac.authorization.k8s.io

```

Can I get help to know why this is happening and how to solve that?  
Thank you very much

---

<div class="post-metadata">

**Author:** ![Ahmad\_Al-Masry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmad_al-masry/32/65270_2.png) [@Ahmad\_Al-Masry](https://discuss.elastic.co/u/Ahmad_Al-Masry)\
**Post date:** [June 14, 2021, 7:48am UTC](https://discuss.elastic.co/t/packetbeat-deployed-using-eck-crashes/274791/2 "2021-06-14T07:48:01Z")

</div>

Any help would be appreciated 🙂

---

<div class="post-metadata">

**Author:** ![michael.morello](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael.morello/32/47448_2.png) [@michael.morello](https://discuss.elastic.co/u/michael.morello)\
**Post date:** [June 14, 2021, 1:12pm UTC](https://discuss.elastic.co/t/packetbeat-deployed-using-eck-crashes/274791/3 "2021-06-14T13:12:21Z")

</div>

Sorry, I'm not able to reproduce. I used the exact same resources on EKS 1.20.4 running on Bottlerocket and it seems to be working as expected:

- Bottlerocket OS 1.1.1
- containerd://1.4.4+bottlerocket
- Kubelet v1.20.6

```auto
% k get es,kb,beats,pods  
NAME HEALTH NODES VERSION PHASE AGE
elasticsearch.elasticsearch.k8s.elastic.co/elastic green 3 7.13.0 Ready 13m

NAME HEALTH NODES VERSION AGE
kibana.kibana.k8s.elastic.co/elastic green 1 7.13.0 13m

NAME HEALTH AVAILABLE EXPECTED TYPE VERSION AGE
beat.beat.k8s.elastic.co/elastic-pb green 3 3 packetbeat 7.13.0 13m

NAME READY STATUS RESTARTS AGE
pod/elastic-es-default-0 1/1 Running 0 13m
pod/elastic-es-default-1 1/1 Running 0 13m
pod/elastic-es-default-2 1/1 Running 0 13m
pod/elastic-kb-5c86cf69b9-lxc6h 1/1 Running 0 9m55s
pod/elastic-pb-beat-packetbeat-66lt9 1/1 Running 1 9m53s
pod/elastic-pb-beat-packetbeat-9q555 1/1 Running 1 9m42s
pod/elastic-pb-beat-packetbeat-f4999 1/1 Running 2 9m35s

```

```auto
> GET _cat/indices/packetbeat-7.13.0
green open packetbeat-7.13.0-2021.06.14-000001 VNbpgNP_QM6UTvNzNpkanQ 1 1 5568 0 7.8mb 3.8mb

```

Anything you forgot to mention so I can try to reproduce again ?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2021, 1:12pm UTC](https://discuss.elastic.co/t/packetbeat-deployed-using-eck-crashes/274791/4 "2021-07-12T13:12:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.