microsoft / microsoft/SysmonForLinux

Fedora-version of sysmonforlinux is failing (made for RHEL 8?)

Open
#201 1 comment 0 reactions 1 assignee View on GitHub

@MarioHewardt is already working on this.

Since Apr 2, 2025.

investigate
Dominant language
C
Stars
2.2k
Forks
220
Avg merge
11d 22h
Merged PRs (30d)
2

Description

Describe the issue
We are using https://packages.microsoft.com/fedora/41/prod/ as source for among other packes, fetching sysmonforliux. This program is failing on an actual Fedora 41 Linux machine. The rpm package has actually an «.el8» postfix, hinting this was made under RHEL 8. When fetching a "rhel/9/" version - the same apply with an extension of «.el8», but this will actually run OK on a RHEL 9 machine.

Originally title:
«sysmonforlinux at packages.microsoft.com/fedora/41/prod/Packages/s/ is made for RHEL 8»
at:
https://github.com/microsoft/linux-package-repositories/issues/211

When did the issue occur?
2025-04-01 (This is NOT a «april fools day» ticket ;-)

If applicable, what package did you attempt to install, and from which repo?
sysmonforlinux from this repo:
https://packages.microsoft.com/fedora/41/prod/Packages/s/

Steps to Reproduce

  1. Start with a «vanilla» Fedora 41
  2. Log in as root
  3. wget https://packages.microsoft.com/fedora/41/prod/Packages/s/
  4. grep sysmon index.html
  5. wget https://packages.microsoft.com/fedora/41/prod/Packages/s/sysmonforlinux-1.3.5-0.el8.x86_64.rpm
  6. dnf install -y sysmonforlinux-1.3.5-0.el8.x86_64.rpm
  7. systemctl status sysmon.service
  8. systemctl restart sysmon.service
  9. systemctl status sysmon.service

Actual Result

~ $ ssh hostwithfedora systemctl start sysmon.service 
Job for sysmon.service failed because the control process exited with error code.
See "systemctl status sysmon.service" and "journalctl -xeu sysmon.service" for details.
~ $ 
~ $ 
~ $ ssh hostwithfedora journalctl -xeu sysmon.service
Apr 01 04:28:16 hostwithfedora systemd[1]: sysmon.service: Control process exited, code=exited, status=12/n/a
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ An ExecStart= process belonging to unit sysmon.service has exited.
░░ 
░░ The process' exit code is 'exited' and its exit status is 12.
Apr 01 04:28:16 hostwithfedora systemd[1]: sysmon.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ The unit sysmon.service has entered the 'failed' state with result 'exit-code'.
Apr 01 04:28:16 hostwithfedora systemd[1]: Failed to start sysmon.service - Sysmon event logger.
░░ Subject: A start job for unit sysmon.service has failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ A start job for unit sysmon.service has finished with a failure.
░░ 
░░ The job identifier is 1192376 and the job result is failed.
Apr 01 04:28:16 hostwithfedora systemd[1]: sysmon.service: Consumed 313ms CPU time, 96.5M memory peak.
░░ Subject: Resources consumed by unit runtime
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ The unit sysmon.service completed and consumed the indicated resources.
Apr 01 04:28:26 hostwithfedora systemd[1]: sysmon.service: Scheduled restart job, restart counter is at 5.
░░ Subject: Automatic restarting of a unit has been scheduled
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ Automatic restarting of the unit sysmon.service has been scheduled, as the result for
░░ the configured Restart= setting for the unit.
Apr 01 04:28:26 hostwithfedora systemd[1]: sysmon.service: Start request repeated too quickly.
Apr 01 04:28:26 hostwithfedora systemd[1]: sysmon.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel

Expected Result
The sysmon service should have started flawlessly

Screenshots

Additional context
The solution might be to compile the sysmonforlinux on a Fedora 41 platform, and build the rpm from there.

Note:
Fedora 42 is coming quite soon (04/24/2025 ?) and is already available as Beta, so please make a working sysmonforlinux for:

  • RHEL 9
  • Fedora 41
  • Fedora 42
  • also soon to be release: RHEL 10

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.