Still getting an error when starting auditbeat with default settings:
Closed issue: #6091
2018-02-26T12:40:42.736-0600 ERROR [auditd] auditd/audit_linux.go:110 Failure receiving audit events {"error": "failed to set audit PID. An audit process is already running (PID 670)"}
auditbeat.modules:
- module: auditd
audit_rules: |
-a always,exit -F arch=b64 -S execve,execveat -k exec
Still getting an error when starting auditbeat with default settings:
Closed issue: #6091
2018-02-26T12:40:42.736-0600 ERROR [auditd] auditd/audit_linux.go:110 Failure receiving audit events {"error": "failed to set audit PID. An audit process is already running (PID 670)"}