# System/socket module stops auditbeat 7.4 from starting (ipv6 detection) **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [October 1, 2019, 6:15pm UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852 "2019-10-01T18:15:14Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![stephan13360](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@stephan13360](https://discuss.elastic.co/u/stephan13360)\ **Post date:** [October 1, 2019, 6:15pm UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/1 "2019-10-01T18:15:14Z")
With the update to 7.4 some of my auditbeats now longer start. (for me the ones running on digitalocean). The error is: ERROR instance/beat.go:878 Exiting: 1 error: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess\_sockaddr\_in6 failed: timeout while waiting for trigger to complete When I disable ipv6 (socket.enable\_ipv6: false) it starts again. I guess this is probably a bug with the new Linux KProbes implementation in 7.4. Anyone else seeing this? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [October 1, 2019, 7:30pm UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/2 "2019-10-01T19:30:41Z")
What's the operating system and version? ---
**Author:** ![danielsnelling](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@danielsnelling](https://discuss.elastic.co/u/danielsnelling)\ **Post date:** [October 2, 2019, 6:32am UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/3 "2019-10-02T06:32:14Z")
I have a similar issue on Ubuntu 18.04 LTS: ``` Exiting: 1 error: 1 error: system/socket dataset setup failed: error detecting IPv6 support: ipv6 socket failed: address family not supported by protocol ``` ---
**Author:** ![jaysee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaysee/32/55250_2.png) [@jaysee](https://discuss.elastic.co/u/jaysee)\ **Post date:** [October 2, 2019, 2:09pm UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/4 "2019-10-02T14:09:23Z")
Same issue, just upgrade to 7.4 and seems to be happening to the hosts where I do have ipv6 enabled in the OS. Ubuntu 18.04 LTS adding socket.enable\_ipv6: false to auditbeat.yml does seem to fix it. ---
**Author:** ![stephan13360](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@stephan13360](https://discuss.elastic.co/u/stephan13360)\ **Post date:** [October 5, 2019, 10:00pm UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/5 "2019-10-05T22:00:14Z")
Ubuntu 18.04 ---
**Author:** ![elastic22](https://avatars.discourse-cdn.com/v4/letter/e/6de8d8/32.png) [@elastic22](https://discuss.elastic.co/u/elastic22)\ **Post date:** [October 7, 2019, 7:14am UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/6 "2019-10-07T07:14:57Z")
Same issue here on latest CentOS 7. We have a dual-stack (IPv4 and IPv6) environment. ``` cat /etc/centos-release CentOS Linux release 7.7.1908 (Core) uname -a Linux HOSTNAME-OMITTED 3.10.0-1062.1.1.el7.x86_64 #1 SMP Fri Sep 13 22:55:44 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux rpm -qa | grep auditbeat auditbeat-7.4.0-1.x86_64 ``` Workaround currently is to disable socket.enable\_ipv6 option in the auditbeat config: ``` - module: system socket.enable_ipv6: false ``` ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [October 7, 2019, 9:33pm UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/7 "2019-10-07T21:33:04Z")
I've attempted to reproduce the problem without any luck. Tried: Ubuntu 18.04 running in DigitalOcean (4.15.0-58-generic) CentOS 7.7 (3.10.0-1062.1.1.el7.x86\_64) Also created the following issue to track the problem: > Can you please help me figure out this issue so I can fix it? @stephan13360 @danielsnelling @jaysee @elastic22 If possible provide the following information, here, or via private message or in the GitHub issue: - Debug log of auditbeat with default ipv6 configuration. `auditbeat run -e -d '*'` - Output of `ip -6 a` - Output of `ip -6 a add fd12:3456::1111 dev lo` - Output of `sysctl -a | grep ipv6` Thanks! ---
**Author:** ![danielsnelling](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@danielsnelling](https://discuss.elastic.co/u/danielsnelling)\ **Post date:** [October 7, 2019, 9:58pm UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/8 "2019-10-07T21:58:22Z")
@adrisr I've added info to the GitHub issue. Points to note for my particular problem are: - Azure Ubuntu image - Kernel version 5 - IPv6 disabled - CIS hardened OS ---
**Author:** ![mirketto82](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@mirketto82](https://discuss.elastic.co/u/mirketto82)\ **Post date:** [October 9, 2019, 9:03am UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/9 "2019-10-09T09:03:59Z")
the same issue with Oracle Linux 7 ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [October 9, 2019, 3:01pm UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/10 "2019-10-09T15:01:51Z")
@mirketto82 Can you test with the packages shared in the github issue above? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 30, 2019, 3:01pm UTC](https://discuss.elastic.co/t/system-socket-module-stops-auditbeat-7-4-from-starting-ipv6-detection/201852/11 "2019-10-30T15:01:59Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.