# Unable to start Auditbeat on Proxmox Container

**URL:** <https://discuss.elastic.co/t/unable-to-start-auditbeat-on-proxmox-container/333886>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [May 19, 2023, 7:37pm UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-proxmox-container/333886 "2023-05-19T19:37:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tli](https://avatars.discourse-cdn.com/v4/letter/t/50afbb/32.png) [@tli](https://discuss.elastic.co/u/tli)\
**Post date:** [May 19, 2023, 7:37pm UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-proxmox-container/333886/1 "2023-05-19T19:37:24Z")

</div>

Hi,

I tried to install auditbeat on Proxmox Container (Ubuntu)  
It failed with following msg written to the log

```auto

2023-05-19T15:03:04.117-0400 INFO instance/beat.go:309 Setup Beat: auditbeat; Version: 7.15.0
2023-05-19T15:03:04.117-0400 INFO [publisher] pipeline/module.go:113 Beat name: <xxxxx>
2023-05-19T15:03:04.119-0400 INFO [auditd] auditd/audit_linux.go:107 auditd module is running as euid=0 on kernel=5.4.203-1-pve
2023-05-19T15:03:04.119-0400 INFO instance/beat.go:442 auditbeat stopped.
2023-05-19T15:03:04.120-0400 ERROR instance/beat.go:989 Exiting: 1 error: failed to create audit client: failed to get audit status: operation not permitted

```

Any suggestions would be appreciated.

Thanks

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 22, 2023, 4:36pm UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-proxmox-container/333886/2 "2023-05-22T16:36:15Z")

</div>

If you are running within a container then you likely need to give the container some additional capabilities that are normally restricted if you are using Docker and the like.

> **[Run Auditbeat on Docker | Auditbeat Reference \[8.7\] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html#_special_requirements)**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2023, 6:36pm UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-proxmox-container/333886/3 "2023-06-19T18:36:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.