# Run Auditbeat with non-root user

**URL:** <https://discuss.elastic.co/t/run-auditbeat-with-non-root-user/193707>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [August 5, 2019, 3:06am UTC](https://discuss.elastic.co/t/run-auditbeat-with-non-root-user/193707 "2019-08-05T03:06:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel6](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@Daniel6](https://discuss.elastic.co/u/Daniel6)\
**Post date:** [August 5, 2019, 3:06am UTC](https://discuss.elastic.co/t/run-auditbeat-with-non-root-user/193707/1 "2019-08-05T03:06:21Z")

</div>

Hi Elastic Team,  
I run ELK on Linux(CentOS7).  
Because of **security issue** , I need to **run Auditbeat with non-root user**.

When runing Auditbeat with non-root user, it shows:

```
2019-08 WARN [cfgwarn] host/host.go:167 BETA: The system/host dataset is beta
2019-08 WARN [cfgwarn] login/login.go:95 BETA: The system/login dataset is beta
2019-08 WARN [cfgwarn] package/package.go:169 BETA: The system/package dataset is beta
2019-08 WARN [cfgwarn] process/process.go:131 BETA: The system/process dataset is beta
2019-08 WARN [process] process/process.go:174 Running as non-root user, will likely not report all processes.
2019-08 WARN [cfgwarn] socket/socket.go:245 BETA: The system/socket dataset is beta
2019-08 WARN [cfgwarn] user/user.go:205 BETA: The system/user dataset is beta
2019-08 INFO instance/beat.go:385 auditbeat stopped.
2019-08 ERROR instance/beat.go:877 Exiting: 1 error: 1 error: failed to create audit client: failed to get audit status: operation not permitted
Exiting: 1 error: 1 error: failed to create audit client: failed to get audit status: operation not permitted`

```

Does anyone know **what capabilities needed when running Auditbeat**?  
[capability doc](http://man7.org/linux/man-pages/man7/capabilities.7.html)

Any suggestion will be really grateful!  
Daniel.

---

<div class="post-metadata">

**Author:** ![Daniel6](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@Daniel6](https://discuss.elastic.co/u/Daniel6)\
**Post date:** [August 23, 2019, 2:30am UTC](https://discuss.elastic.co/t/run-auditbeat-with-non-root-user/193707/2 "2019-08-23T02:30:06Z")

</div>

use this command:

`setcap cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog=ep auditbeat`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2019, 2:30am UTC](https://discuss.elastic.co/t/run-auditbeat-with-non-root-user/193707/3 "2019-09-13T02:30:07Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.