# Service does not start - 1 error: 1 error: failed to create audit client: failed to create audit client: audit not supported by kernel: protocol not supported **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [September 4, 2019, 12:25pm UTC](https://discuss.elastic.co/t/service-does-not-start-1-error-1-error-failed-to-create-audit-client-failed-to-create-audit-client-audit-not-supported-by-kernel-protocol-not-supported/198045 "2019-09-04T12:25:51Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![monmac](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@monmac](https://discuss.elastic.co/u/monmac)\ **Post date:** [September 4, 2019, 12:25pm UTC](https://discuss.elastic.co/t/service-does-not-start-1-error-1-error-failed-to-create-audit-client-failed-to-create-audit-client-audit-not-supported-by-kernel-protocol-not-supported/198045/1 "2019-09-04T12:25:51Z")
Service does not start, no error information in the log. Please help auditbeat -e -c auditbeat.yml -d "publish" \>\> ``` WARN [cfgwarn] host/host.go:167 BETA: The system/host dataset is beta WARN [cfgwarn] login/login.go:95 BETA: The system/login dataset is beta WARN [cfgwarn] package/package.go:170 BETA: The system/package dataset is beta WARN [cfgwarn] process/process.go:131 BETA: The system/process dataset is beta WARN [cfgwarn] socket/socket.go:245 BETA: The system/socket dataset is beta ``` ## WARN [cfgwarn] user/user.go:205 BETA: The system/user dataset is beta INFO instance/beat.go:385 auditbeat stopped. ERROR instance/beat.go:877 Exiting: 1 error: 1 error: failed to create audit client: failed to create audit client: audit not supported by kernel: protocol not supported Exiting: 1 error: 1 error: failed to create audit client: failed to create audit client: audit not supported by kernel: protocol not supported systemctl status auditbeat \>\> systemd[1]: auditbeat.service: Unit entered failed state. systemd[1]: auditbeat.service: Failed with result 'exit-code'. systemd[1]: auditbeat.service: Service hold-off time over, scheduling restart. systemd[1]: Stopped Audit the activities of users and processes on your system.. systemd[1]: auditbeat.service: Start request repeated too quickly. systemd[1]: Failed to start Audit the activities of users and processes on your system.. ---
**Author:** ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)\ **Post date:** [September 4, 2019, 6:36pm UTC](https://discuss.elastic.co/t/service-does-not-start-1-error-1-error-failed-to-create-audit-client-failed-to-create-audit-client-audit-not-supported-by-kernel-protocol-not-supported/198045/2 "2019-09-04T18:36:23Z")
Hello, welcome to the Elastic community. Which version of auditbeat are you running when you encounter these errors? Also which version and release of Linux are you running? Thanks. ---
**Author:** ![monmac](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@monmac](https://discuss.elastic.co/u/monmac)\ **Post date:** [September 5, 2019, 9:27am UTC](https://discuss.elastic.co/t/service-does-not-start-1-error-1-error-failed-to-create-audit-client-failed-to-create-audit-client-audit-not-supported-by-kernel-protocol-not-supported/198045/3 "2019-09-05T09:27:53Z")
Hi, thank you for taking care of this matter, auditbeat version 7.3.1 (amd64), libbeat 7.3.1 and Description: Ubuntu 16.04.3 LTS Release: 16.04 Codename: xenial I found information about no support for this kernel, What to do with this? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 26, 2019, 9:28am UTC](https://discuss.elastic.co/t/service-does-not-start-1-error-1-error-failed-to-create-audit-client-failed-to-create-audit-client-audit-not-supported-by-kernel-protocol-not-supported/198045/4 "2019-09-26T09:28:30Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.