# Windows - packetbeat service failed to start **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [September 17, 2015, 9:17pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523 "2015-09-17T21:17:46Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![inlikefletch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inlikefletch/32/4834_2.png) [@inlikefletch](https://discuss.elastic.co/u/inlikefletch)\ **Post date:** [September 17, 2015, 9:17pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/1 "2015-09-17T21:17:46Z")
Hi, I am having trouble starting the packetbeat service on my application servers and local elk stack. Even if I install on my local elasticsearch server, windows server, keep the default yml file because those configurations are fine, I get the following in the log: _The packetbeat service failed to start due to the following error:_ _The service did not respond to the start or control request in a timely fashion._ This is on a Windows Server 2012 R2 server. ps1 install works fine. The service is installed and in stopped state. But cannot start. Using packetbeat-1.0.0-beta3-windows binaries. Thanks, Jason ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [September 18, 2015, 7:34am UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/2 "2015-09-18T07:34:26Z")
Just to confirm, you are starting the service from Powershell like this, right: ``` Start-Service packetbeat ``` The log files should be created under `C:\ProgramData\packetbeat\Logs`. Please have a look if Packetbeat prints any errors there. ---
**Author:** ![inlikefletch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inlikefletch/32/4834_2.png) [@inlikefletch](https://discuss.elastic.co/u/inlikefletch)\ **Post date:** [September 18, 2015, 2:53pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/3 "2015-09-18T14:53:00Z")
Figured it out Tudor! WinPCap needs to be installed. Thanks, Jason ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [September 18, 2015, 2:54pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/4 "2015-09-18T14:54:21Z")
Oh yeah, it does :-). Glad it's working and thanks for reporting back. ---
**Author:** ![inlikefletch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inlikefletch/32/4834_2.png) [@inlikefletch](https://discuss.elastic.co/u/inlikefletch)\ **Post date:** [September 18, 2015, 4:32pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/5 "2015-09-18T16:32:54Z")
Hi Tudor, Working great now, if I specific which device I want it to listen on, 0 or 1. But if I try to set to any, i get the following: _CRIT Initializing sniffer failed: Error creating sniffer: Error opening adapter: The system cannot find the device specified. (20)_ Should it be: _device: any_ or _device: "any"_ or something else in packetbeat.yml ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [September 20, 2015, 7:34pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/6 "2015-09-20T19:34:10Z")
Device type "any" is unfortunately not supported on Windows. ---
**Author:** ![congpine](https://avatars.discourse-cdn.com/v4/letter/c/65b543/32.png) [@congpine](https://discuss.elastic.co/u/congpine)\ **Post date:** [December 1, 2015, 3:58pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/7 "2015-12-01T15:58:12Z")
Hi I'm having the similar issue on Packetbeat 1.0.0 I have installed WinPcap and running packetbeat.exe in CMD windows works fine. I tried to start the service in Service Manager and hit the same error. I tried to start it with PowerShell (as Administrator) and it gave me the following error ( image attached) ![](https://us1.discourse-cdn.com/elastic/original/2X/5/5c73d4d2b0dc853adcb35495e5ea7b9803463aac.png) I'm running Windows 8 any ideas? ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [December 1, 2015, 9:06pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/8 "2015-12-01T21:06:43Z")
Please check the logs under `c:\programdata\packetbeat\logs`. They might contain useful information for the issue. ---
**Author:** ![congpine](https://avatars.discourse-cdn.com/v4/letter/c/65b543/32.png) [@congpine](https://discuss.elastic.co/u/congpine)\ **Post date:** [December 1, 2015, 9:48pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/9 "2015-12-01T21:48:19Z")
Hi @Tudo I did check that log, but it doesn't contain any latest info. The last logs was few days ago- on 26th Nov 2015. ---
**Author:** ![congpine](https://avatars.discourse-cdn.com/v4/letter/c/65b543/32.png) [@congpine](https://discuss.elastic.co/u/congpine)\ **Post date:** [December 2, 2015, 3:46pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/10 "2015-12-02T15:46:42Z")
Hi I think I have found where the issue is. I found out about this while working with filebeat. It's the space in the path. I have filebeat/packetbeat installed at C:/Program File/beats/ Basically, the windows service is created as: `C:/Program File/beats/filebeat.exe -c C:/Program File/beats/filebeat.yml` and service will fail to launch . when I added double-quote to the path, the service starts fine. `"C:/Program File/beats/filebeat.exe" -c "C:/Program File/beats/filebeat.yml"` I have modified `install-service-filebeat.ps1` as: ```auto -binaryPathName "`"$workdir\\filebeat.exe `" -c `"$workdir\\filebeat.yml `"" ``` I'm going to test this on packetbeat installation. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [December 2, 2015, 4:04pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/11 "2015-12-02T16:04:53Z")
That seems to be the same issue that was fixed here: [https://github.com/elastic/beats-packer/pull/32](https://github.com/elastic/beats-packer/pull/32) ---
**Author:** ![Amarnath\_palavalli](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Amarnath\_palavalli](https://discuss.elastic.co/u/Amarnath_palavalli)\ **Post date:** [January 14, 2016, 8:40am UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/12 "2016-01-14T08:40:32Z")
I still see the same error even with version packetbeat 1.0.1. I checked the powershell version and all pre-requisites for the commands to deploy and configure beats. Please help. Start-Service : Service 'packetbeat (packetbeat)' cannot be started due to the following error: Cannot start service packetbeat on computer '.'. At line:1 char:1 - Start-Service packetbeat - ```auto + CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand ``` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [January 14, 2016, 4:41pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/13 "2016-01-14T16:41:47Z")
Hi @Amarnath_palavalli, Could you run the following PowerShell command on your system that will show us the exact command being executed when the service runs. Paste the output in your response. ```auto PS C:\Users\vagrant> gwmi -Query "select * from win32_service where name like '%beat'" | Format-Table -Property Name, PathName -AutoSize -Wrap Name PathName ---- -------- packetbeat "C:\Program Files\Packetbeat\\packetbeat.exe" -c "C:\Program Files\Packetbeat\\packetbeat.yml" ``` The next step is to try running the listed command on the command line, instead of as a service. In PowerShell, prepend an ampersand (&) to the command and append the options to log debugging messages to the console (`-e -v -d "*"`). ```auto PS C:\Users\vagrant>& "C:\Program Files\Packetbeat\\packetbeat.exe" -c "C:\Program Files\Packetbeat\\packetbeat.yml" -e -v -d "*" ``` See if Packetbeat starts running or fails to due an error. Please post your formatted config file too. ---
**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Post date:** [April 29, 2016, 4:51am UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/14 "2016-04-29T04:51:15Z")
I am starting packetbeat and topbeat on windows but turn out giving similar results as mentioned above. When I type **Start-Service topbeat** or **Start-Service packetbeat** , it gives me the result: PS C:\Packetbeat\> Start-Service packetbeat Start-Service : Cannot find any service with service name 'packetbeat'. At line:1 char:1 - Start-Service packetbeat ... And I could not find the directory "programdata" under C drive ---
**Author:** ![krushnat\_khawale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krushnat_khawale/32/6652_2.png) [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Post date:** [May 2, 2016, 8:12am UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/15 "2016-05-02T08:12:33Z")
Post your configuration @Kennedy_Kan1, it would be useful. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:52pm UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523/16 "2017-07-05T21:52:37Z")