# Unable to monitor the host machine via Auditbeat Docker **URL:** \ **Category:** Beats\ **Tags:** docker, auditbeat\ **Created:** [November 7, 2019, 9:55am UTC](https://discuss.elastic.co/t/unable-to-monitor-the-host-machine-via-auditbeat-docker/206941 "2019-11-07T09:55:24Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![jdouk](https://avatars.discourse-cdn.com/v4/letter/j/22d042/32.png) [@jdouk](https://discuss.elastic.co/u/jdouk)\ **Post date:** [November 7, 2019, 9:55am UTC](https://discuss.elastic.co/t/unable-to-monitor-the-host-machine-via-auditbeat-docker/206941/1 "2019-11-07T09:55:24Z")
I have been trying to monitor my host using Auditbeat docker but so far I am unable to see any login attemps to my ELK stack (SIEM). The container runs without any problems. Here is the command used to bring up the contaner: docker run --name=auditbeat --user=root --cap-add=AUDIT\_CONTROL --cap-add=AUDIT\_READ --pid=host --privileged=true --volume=/var/run/docker.sock:/var/run/docker.sock [docker.elastic.co/beats/auditbeat:7.4.2](http://docker.elastic.co/beats/auditbeat:7.4.2) -e -E output.elasticsearch.hosts=["elasticsearch:9200"] Here are the rules running auditctl -l -a never,exit -S all -F pid=15025 -w /etc/passwd -p wa -k identity -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open\_by\_handle\_at -F exit=-EPERM -F key=access auditctl -s enabled 1 failure 0 pid 15025 rate\_limit 0 backlog\_limit 8192 lost 0 backlog 0 backlog\_wait\_time 0 loginuid\_immutable 0 unlocked Any idea what is still missing? Thanks in advance ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2019, 9:55am UTC](https://discuss.elastic.co/t/unable-to-monitor-the-host-machine-via-auditbeat-docker/206941/2 "2019-11-28T09:55:29Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.