# Packetbeat8.0 af\_packet report errors

**URL:** <https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [February 24, 2022, 2:51pm UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180 "2022-02-24T14:51:17Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![chinaxushi](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\
**Post date:** [February 24, 2022, 2:51pm UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180/1 "2022-02-24T14:51:17Z")

</div>

- Packetbeat Version: 8.0
- Operating System: Rocky Linux 8.5

After the "af\_packet" mode is enabled in the configuration file, Packetbeat will report an error and prompt "exiting: sniffer loop failed: sniffing error: packet poll timeout expired"

On the same machine, Packetbeat7.17 has no problem running the same configuration file

---

<div class="post-metadata">

**Author:** ![chinaxushi](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\
**Post date:** [February 28, 2022, 1:54am UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180/2 "2022-02-28T01:54:03Z")

</div>

packetbeat export config output：

```auto
output:
  console:
    enabled: true
    pretty: true
packetbeat:
  flows:
    period: 10s
    timeout: 30s
  interfaces:
    device: any
    internal_networks:
    - private
    type: af_packet
  protocols:
  - enabled: false
    type: icmp
  - ports:
    - 80
    - 8082
    - 8000
    - 5000
    - 8002
    type: http
path:
  config: /packetbeat8
  data: /packetbeat8/data
  home: /packetbeat8
  logs: /packetbeat8/logs
processors:
- else:
  - add_host_metadata: null
  if:
    contains:
      tags: forwarded
  then:
  - drop_fields:
      fields:
      - host
- add_cloud_metadata: null
- add_docker_metadata: null
- detect_mime_type:
    field: http.request.body.content
    target: http.request.mime_type
- detect_mime_type:
    field: http.response.body.content
    target: http.response.mime_type

```

Error reporting in log

```auto
{"log.level":"error","@timestamp":"2022-02-28T09:40:29.752+0800","log.origin":{"file.name":"instance/beat.go","file.line":1025},"message":"Exiting: sniffer loop failed: Sniffing error: packet poll timeout expired","service.name":"packetbeat","ecs.version":"1.6.0"}

```

---

<div class="post-metadata">

**Author:** ![chinaxushi](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\
**Post date:** [March 2, 2022, 7:11am UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180/3 "2022-03-02T07:11:39Z")

</div>

In most cases, it will report an error and exit soon. Occasionally, it will exit after running for a period of time. Today, it has been running for more than 2 minutes。

```auto
{"log.level":"info","@timestamp":"2022-03-02T15:07:30.143+0800","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":193},"message":"Uptime: 2m0.402134077s","service.name":"packetbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-03-02T15:07:30.143+0800","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":160},"message":"Stopping metrics logging.","service.name":"packetbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-03-02T15:07:30.143+0800","log.origin":{"file.name":"instance/beat.go","file.line":504},"message":"packetbeat stopped.","service.name":"packetbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-03-02T15:07:30.143+0800","log.origin":{"file.name":"instance/beat.go","file.line":1025},"message":"Exiting: sniffer loop failed: Sniffing error: packet poll timeout expired","service.name":"packetbeat","ecs.version":"1.6.0"}
Exiting: sniffer loop failed: Sniffing error: packet poll timeout expired

```

---

<div class="post-metadata">

**Author:** ![chinaxushi](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\
**Post date:** [March 8, 2022, 8:34am UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180/4 "2022-03-08T08:34:56Z")

</div>

Recent tests have found strange things,

```auto
./packetbeat -c packetbeat-console.yml -d "sniffer"

```

Starting with this parameter will get the same phenomenon as before. After a while, it will return an error and exit,

```auto
./packetbeat -c packetbeat-console.yml -d "sniffer" -e

```

If - e is added to the parameter, the operation will be OK. I've been running for at least 10 minutes

---

<div class="post-metadata">

**Author:** ![chinaxushi](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\
**Post date:** [March 14, 2022, 7:36am UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180/5 "2022-03-14T07:36:34Z")

</div>

Should this be a bug? Can no one reproduce?

---

<div class="post-metadata">

**Author:** ![Adam\_Fink](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adam_fink/32/45742_2.png) [@Adam\_Fink](https://discuss.elastic.co/u/Adam_Fink)\
**Post date:** [March 16, 2022, 4:54pm UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180/7 "2022-03-16T16:54:14Z")

</div>

Hey @chinaxushi ! I'm working with a customer observing this same issue so I'm pretty sure this is a bug with the 8.x versions. I'll see what I can do to get some eyes on this for you. Cheers!

---

<div class="post-metadata">

**Author:** ![franpom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/franpom/32/117025_2.png) [@franpom](https://discuss.elastic.co/u/franpom)\
**Post date:** [March 21, 2022, 4:27pm UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180/10 "2022-03-21T16:27:14Z")

</div>

Hello,  
I have the same problem after upgrading to 8.1.

---

<div class="post-metadata">

**Author:** ![testersay\_testersay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/testersay_testersay/32/103316_2.png) [@testersay\_testersay](https://discuss.elastic.co/u/testersay_testersay)\
**Post date:** [March 21, 2022, 5:27pm UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180/19 "2022-03-21T17:27:29Z")

</div>

>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2022, 7:28pm UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180/20 "2022-04-18T19:28:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.