Windows - packetbeat service failed to start


I am having trouble starting the packetbeat service on my application servers and local elk stack. Even if I install on my local elasticsearch server, windows server, keep the default yml file because those configurations are fine, I get the following in the log:

The packetbeat service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

This is on a Windows Server 2012 R2 server. ps1 install works fine. The service is installed and in stopped state. But cannot start. Using packetbeat-1.0.0-beta3-windows binaries.


(Tudor Golubenco) #2

Just to confirm, you are starting the service from Powershell like this, right:

Start-Service packetbeat

The log files should be created under C:\ProgramData\packetbeat\Logs. Please have a look if Packetbeat prints any errors there.


Figured it out Tudor! WinPCap needs to be installed.


(Tudor Golubenco) #4

Oh yeah, it does :-). Glad it's working and thanks for reporting back.


Hi Tudor,
Working great now, if I specific which device I want it to listen on, 0 or 1. But if I try to set to any, i get the following:
CRIT Initializing sniffer failed: Error creating sniffer: Error opening adapter: The system cannot find the device specified. (20)

Should it be:
device: any
device: "any"
or something else in packetbeat.yml

(Tudor Golubenco) #6

Device type "any" is unfortunately not supported on Windows.

(cong) #7

I'm having the similar issue on Packetbeat 1.0.0
I have installed WinPcap and running packetbeat.exe in CMD windows works fine.
I tried to start the service in Service Manager and hit the same error.

I tried to start it with PowerShell (as Administrator) and it gave me the following error ( image attached)

I'm running Windows 8

any ideas?

(Tudor Golubenco) #8

Please check the logs under c:\programdata\packetbeat\logs. They might contain useful information for the issue.

(cong) #9

Hi @Tudo
I did check that log, but it doesn't contain any latest info.
The last logs was few days ago- on 26th Nov 2015.

(cong) #10

I think I have found where the issue is.
I found out about this while working with filebeat.
It's the space in the path.
I have filebeat/packetbeat installed at C:/Program File/beats/
Basically, the windows service is created as:
C:/Program File/beats/filebeat.exe -c C:/Program File/beats/filebeat.yml
and service will fail to launch .
when I added double-quote to the path, the service starts fine.
"C:/Program File/beats/filebeat.exe" -c "C:/Program File/beats/filebeat.yml"
I have modified install-service-filebeat.ps1 as:

-binaryPathName "`"$workdir\\filebeat.exe `" -c `"$workdir\\filebeat.yml `""

I'm going to test this on packetbeat installation.

(ruflin) #11

That seems to be the same issue that was fixed here:

(Amarnath Palavalli) #12

I still see the same error even with version packetbeat 1.0.1. I checked the powershell version and all pre-requisites for the commands to deploy and configure beats. Please help.

Start-Service : Service 'packetbeat (packetbeat)' cannot be started due to the following error: Cannot start service
packetbeat on computer '.'.
At line:1 char:1

  • Start-Service packetbeat
  •   + CategoryInfo          : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service],
      + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand

(Andrew Kroh) #13

Hi @Amarnath_palavalli,

Could you run the following PowerShell command on your system that will show us the exact command being executed when the service runs. Paste the output in your response.

PS C:\Users\vagrant> gwmi -Query "select * from win32_service where name like '%beat'" | Format-Table -Property Name, PathName -AutoSize -Wrap

Name       PathName
----       --------
packetbeat "C:\Program Files\Packetbeat\\packetbeat.exe" -c "C:\Program Files\Packetbeat\\packetbeat.yml"

The next step is to try running the listed command on the command line, instead of as a service. In PowerShell, prepend an ampersand (&) to the command and append the options to log debugging messages to the console (-e -v -d "*").

PS C:\Users\vagrant>& "C:\Program Files\Packetbeat\\packetbeat.exe" -c "C:\Program Files\Packetbeat\\packetbeat.yml" -e -v -d "*"

See if Packetbeat starts running or fails to due an error.

Please post your formatted config file too.

(Kennedy Kan) #14

I am starting packetbeat and topbeat on windows but turn out giving similar results as mentioned above.

When I type Start-Service topbeat or Start-Service packetbeat, it gives me the result:
PS C:\Packetbeat> Start-Service packetbeat
Start-Service : Cannot find any service with service name 'packetbeat'.
At line:1 char:1

  • Start-Service packetbeat

And I could not find the directory "programdata" under C drive

(Krushnat Khawale) #15

Post your configuration @Kennedy_Kan1, it would be useful.

(system) #16