# System/socket dataset setup failed **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [December 4, 2019, 5:21pm UTC](https://discuss.elastic.co/t/system-socket-dataset-setup-failed/210574 "2019-12-04T17:21:42Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Willl](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@Willl](https://discuss.elastic.co/u/Willl)\ **Post date:** [December 4, 2019, 5:21pm UTC](https://discuss.elastic.co/t/system-socket-dataset-setup-failed/210574/1 "2019-12-04T17:21:42Z")
Testing auditbeat-7.5.0-1-x86\_64 on SLES 12 SP4. When the socket dataset is enabled under module system, auditbeat restarts. I checked the release note which says ipv6.disable=1 is taken care of. Any suggestion? > Blockquote auditbeat[20739]: 2019-12-04T12:13:18.733-0500#011WARN#011[cfgwarn]#011socket/socket\_linux.go:87#011BETA: The system/socket dataset is beta. > auditbeat[20739]: 2019-12-04T12:13:18.765-0500#011INFO#011[socket]#011socket/socket\_linux.go:223#011Setting up system/socket for kernel 4.12.14-94.41-default > auditbeat[20739]: 2019-12-04T12:13:18.877-0500#011INFO#011[socket]#011guess/guess.go:258#011Running 16 guesses ... > auditbeat[20739]: 2019-12-04T12:13:21.720-0500#011INFO#011add\_cloud\_metadata/add\_cloud\_metadata.go:89#011add\_cloud\_metadata: hosting provider type not detected. > auditbeat[20739]: 2019-12-04T12:13:34.068-0500#011INFO#011instance/beat.go:402#011auditbeat stopped. > auditbeat[20739]: 2019-12-04T12:13:34.069-0500#011ERROR#011instance/beat.go:916#011Exiting: 1 error: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess\_sk\_buff\_proto failed: timeout while waiting for event > auditbeat[20739]: Exiting: 1 error: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess\_sk\_buff\_proto failed: timeout while waiting for event > systemd[1]: auditbeat.service: Main process exited, code=exited, status=1/FAILURE > systemd[1]: auditbeat.service: Unit entered failed state. > systemd[1]: auditbeat.service: Failed with result 'exit-code'. > systemd[1]: auditbeat.service: Service RestartSec=100ms expired, scheduling restart. > systemd[1]: Stopped Audit the activities of users and processes on your system.. > systemd[1]: Started Audit the activities of users and processes on your system.. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [December 12, 2019, 12:37pm UTC](https://discuss.elastic.co/t/system-socket-dataset-setup-failed/210574/2 "2019-12-12T12:37:20Z")
Hi, It worked for me for SLES12 sp4 (4.12.14-95.32-default). Both in default configuration and with `ipv6.disable=1`. Can you share your debug logs (run auditbeat with `-d '*'`), and share more information about the machine configuration (if you're disabled ipv6, how, etc)? ---
**Author:** ![Willl](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@Willl](https://discuss.elastic.co/u/Willl)\ **Post date:** [December 18, 2019, 6:22pm UTC](https://discuss.elastic.co/t/system-socket-dataset-setup-failed/210574/3 "2019-12-18T18:22:41Z")
sorry about the delay. We rebuild the testing env and start using ssl. We don't notice this anymore. I'll sure repost with more info if we encounter the same issue again. Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 8, 2020, 6:22pm UTC](https://discuss.elastic.co/t/system-socket-dataset-setup-failed/210574/4 "2020-01-08T18:22:46Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.