# /usr/share/metricbeat/bin/metricbeat exceeds max file size

**URL:** <https://discuss.elastic.co/t/usr-share-metricbeat-bin-metricbeat-exceeds-max-file-size/201783>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [October 1, 2019, 11:14am UTC](https://discuss.elastic.co/t/usr-share-metricbeat-bin-metricbeat-exceeds-max-file-size/201783 "2019-10-01T11:14:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [October 1, 2019, 11:14am UTC](https://discuss.elastic.co/t/usr-share-metricbeat-bin-metricbeat-exceeds-max-file-size/201783/1 "2019-10-01T11:14:10Z")

</div>

Hello

I'm seeing the following warning when starting auditbeat:

`Oct 01 13:10:26 myserver auditbeat[22218]: 2019-10-01T13:10:26.828+0200 WARN [process] process/process.go:234 failed to hash executable /usr/share/metricbeat/bin/metricbeat for PID 24632: failed to hash file /usr/share/metricbeat/bin/metricbeat: hasher: file size 172910019 exceeds max file size`

Is it possible to increase the max file size hasher limit? I find very little info in [https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-dataset-system-process.html](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-dataset-system-process.html)

Tx

---

<div class="post-metadata">

**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\
**Post date:** [October 1, 2019, 1:33pm UTC](https://discuss.elastic.co/t/usr-share-metricbeat-bin-metricbeat-exceeds-max-file-size/201783/2 "2019-10-01T13:33:15Z")

</div>

Yeah, something is weird with the documentation. You can change `process.hash.max_file_size` in the config section for the `system` module. The default is `100 MiB`.

You can find this setting in the `auditbeat.reference.yml` that ships with Auditbeat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2019, 1:33pm UTC](https://discuss.elastic.co/t/usr-share-metricbeat-bin-metricbeat-exceeds-max-file-size/201783/3 "2019-10-22T13:33:40Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.