# Using auditd along with auditbeat **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [January 9, 2020, 5:00am UTC](https://discuss.elastic.co/t/using-auditd-along-with-auditbeat/214342 "2020-01-09T05:00:29Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![akki2208](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akki2208/32/54139_2.png) [@akki2208](https://discuss.elastic.co/u/akki2208)\ **Post date:** [January 9, 2020, 5:00am UTC](https://discuss.elastic.co/t/using-auditd-along-with-auditbeat/214342/1 "2020-01-09T05:00:29Z")
I want to run audit beat along with auditd. is there any option? or can we write auditbeat logs in some file? ---
**Author:** ![vaclav](https://avatars.discourse-cdn.com/v4/letter/v/34f0e0/32.png) [@vaclav](https://discuss.elastic.co/u/vaclav)\ **Post date:** [January 9, 2020, 4:25pm UTC](https://discuss.elastic.co/t/using-auditd-along-with-auditbeat/214342/2 "2020-01-09T16:25:01Z")
from Andrew Kroh: To run the two simultaneously you must use the multicast socket\_type in Auditbeat and you must not set any audit\_rules in your Auditbeat config (they will be managed by auditd). ```auto auditbeat.modules: - module: auditd socket_type: multicast ``` This let's Auditbeat receive a broadcast of the audit messages (just like journald does). output to file: output.file: path: "/var/auditbeat/logs" filename: auditbeat rotate\_every\_kb: 20000 number\_of\_files: 2 permissions: 0644 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 30, 2020, 4:25pm UTC](https://discuss.elastic.co/t/using-auditd-along-with-auditbeat/214342/3 "2020-01-30T16:25:03Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.