# Seccomp default policy is missing clock\_nanosleep
**URL:** https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637
**Category:** Beats
**Tags:** journalbeat, auditbeat
**Created:** [November 23, 2022, 9:28am UTC](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637 "2022-11-23T09:28:11Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@izaneuski](https://discuss.elastic.co/u/izaneuski)
#### Post date: [November 23, 2022, 9:28am UTC](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637/1 "2022-11-23T09:28:11Z")
On some ubuntu hosts I'm facing high CPU consumption by auditbeat(7.16.3&8.5.1) and journalbeat(7.15.2) with default config.
During investigation with strace found out:
```auto
clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=0, tv_nsec=100000000}, NULL) = -1 EPERM (Operation not permitted)
clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=0, tv_nsec=100000000}, NULL) = -1 EPERM (Operation not permitted)
clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=0, tv_nsec=100000000}, NULL) = -1 EPERM (Operation not permitted)
```
Fixed by adding to beat config:
```auto
seccomp:
syscalls:
- action: allow
names:
- clock_nanosleep
```
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 23, 2022, 12:06pm UTC](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637/2 "2022-11-23T12:06:11Z")
Thanks for the report. Can you open an an [issue](https://github.com/elastic/beats/issues/new?assignees=&labels=&template=bug-report.md) on github for this.
Can you include the OS version and glibc deb pkg version there too.
---
### Author:  [@izaneuski](https://discuss.elastic.co/u/izaneuski)
#### Post date: [November 23, 2022, 1:03pm UTC](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637/3 "2022-11-23T13:03:27Z")
>
>
> On some ubuntu hosts I'm facing high CPU consumption by auditbeat(7.16.3&8.5.1) …and journalbeat(7.15.2) with default config.
> During investigation with \`strace\` found out:
> \`\`\`
> clock\_nanosleep(CLOCK\_REALTIME, 0, {tv\_sec=0, tv\_nsec=100000000}, NULL) = -1 EPERM (Operation not permitted)
> clock\_nanosleep(CLOCK\_REALTIME, 0, {tv\_sec=0, tv\_nsec=100000000}, NULL) = -1 EPERM (Operation not permitted)
> clock\_nanosleep(CLOCK\_REALTIME, 0, {tv\_sec=0, tv\_nsec=100000000}, NULL) = -1 EPERM (Operation not permitted)
> \`\`\`
>
> Fixed by adding to beat config:
> \`\`\`
> seccomp:
> syscalls:
> - action: allow
> names:
> - clock\_nanosleep
> \`\`\`
>
> \- Version:
> \`\`\`
> ldd --version
> ldd (Ubuntu GLIBC 2.31-0ubuntu9.9) 2.31
> \`\`\`
>
> \- Operating System:
> \`\`\`
> cat /etc/os-release
> NAME="Ubuntu"
> VERSION="20.04.5 LTS (Focal Fossa)"
> ID=ubuntu
> ID\_LIKE=debian
> PRETTY\_NAME="Ubuntu 20.04.5 LTS"
> VERSION\_ID="20.04"
> HOME\_URL="https://www.ubuntu.com/"
> SUPPORT\_URL="https://help.ubuntu.com/"
> BUG\_REPORT\_URL="https://bugs.launchpad.net/ubuntu/"
> PRIVACY\_POLICY\_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
> VERSION\_CODENAME=focal
> UBUNTU\_CODENAME=focal
> \`\`\`
> \`\`\`
> uname -a
> Linux ip-10-224-140-239 5.15.0-1023-aws #27~20.04.1-Ubuntu SMP Wed Oct 26 20:02:26 UTC 2022 x86\_64 x86\_64 x86\_64 GNU/Linux
> \`\`\`
> \- Discuss Forum URL:
> https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637/1
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637/4 "2022-12-21T15:04:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.