# Problem with Auditbeat system host dashboard

**URL:** <https://discuss.elastic.co/t/problem-with-auditbeat-system-host-dashboard/232693>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [May 14, 2020, 5:59pm UTC](https://discuss.elastic.co/t/problem-with-auditbeat-system-host-dashboard/232693 "2020-05-14T17:59:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![andywt123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andywt123/32/65160_2.png) [@andywt123](https://discuss.elastic.co/u/andywt123)\
**Post date:** [May 14, 2020, 5:59pm UTC](https://discuss.elastic.co/t/problem-with-auditbeat-system-host-dashboard/232693/1 "2020-05-14T17:59:58Z")

</div>

I am testing auditbeat on three hosts. The Auditbeat system host dashboard only shows a host count of 1. The host list has all 3 hosts. Why is host count only 1? How do I troubleshoot or investigate further. I am runing 7.6.2

Thanks

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 14, 2020, 6:21pm UTC](https://discuss.elastic.co/t/problem-with-auditbeat-system-host-dashboard/232693/2 "2020-05-14T18:21:04Z")

</div>

To troubleshoot you can look at the visualization to see how it computes the count. Edit the dashboard, then edit the "Host Count" visualization, then view how the metric is computed.

It's the "Unique count of `host.id`". So then you answer are my `host.id` values unique for each machine by looking at the raw events in the Discover tab.

The `host.id` on Linux is the machine ID taken from the first of "/etc/machine-id", "/var/lib/dbus/machine-id", "/var/db/dbus/machine-id". If the machines were cloned from the same image without reseting the machine ID then they might be the same. You could edit the vizualization to count the unique host.hostname values instead.

---

<div class="post-metadata">

**Author:** ![andywt123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andywt123/32/65160_2.png) [@andywt123](https://discuss.elastic.co/u/andywt123)\
**Post date:** [May 14, 2020, 6:56pm UTC](https://discuss.elastic.co/t/problem-with-auditbeat-system-host-dashboard/232693/3 "2020-05-14T18:56:14Z")

</div>

Thanks, that fixed it

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2020, 6:56pm UTC](https://discuss.elastic.co/t/problem-with-auditbeat-system-host-dashboard/232693/4 "2020-06-04T18:56:23Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.