# Packetbeat flooding logs with FindSocketsOfPid errors when on system with short living processes

**URL:** https://discuss.elastic.co/t/packetbeat-flooding-logs-with-findsocketsofpid-errors-when-on-system-with-short-living-processes/306802
**Category:** Beats
**Tags:** packetbeat
**Created:** [June 9, 2022, 1:39pm UTC](https://discuss.elastic.co/t/packetbeat-flooding-logs-with-findsocketsofpid-errors-when-on-system-with-short-living-processes/306802 "2022-06-09T13:39:44Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Christos\_Arvanitis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos_arvanitis/32/106828_2.png) [@Christos\_Arvanitis](https://discuss.elastic.co/u/Christos_Arvanitis)
#### Post date: [June 9, 2022, 1:39pm UTC](https://discuss.elastic.co/t/packetbeat-flooding-logs-with-findsocketsofpid-errors-when-on-system-with-short-living-processes/306802/1 "2022-06-09T13:39:44Z")

</div>

Hello,

Due to the error logging [here](https://github.com/elastic/beats/blob/main/packetbeat/procs/procs_linux.go#L115), on systems running many short living processes, we realized that packetbeat is flooding logs with entries like the following:

```auto
{"log.level":"error","@timestamp":"2022-06-09T15:25:57.629+0200","log.origin":{"file.name":"procs/procs_linux.go","file.line":115},"message":"FindSocketsOfPid: open /proc/15404/fd: no such file or directory","service.name":"packetbeat","ecs.version":"1.6.0"}

```

This happens when `packetbeat.procs.enabled: true`. We cannot find any way to disable such log messages (while keeping the level to error to still get useful logs) and believe that this should not be logged as an error, given that the execution is continuing.

Process data is added on best effort, given that packetbeat process info is originating from procfs. In case of short living processes, no process data is added considering that by the time this enrichment takes place, the connected procfs directory may not exist.

This type of log entry should be on level `warning` or info, so as to support best-effort enrichment without flooding the logs.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 7, 2022, 3:40pm UTC](https://discuss.elastic.co/t/packetbeat-flooding-logs-with-findsocketsofpid-errors-when-on-system-with-short-living-processes/306802/2 "2022-07-07T15:40:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
