microsoft / microsoft/SysmonForLinux
Sysmon event 3 is not detecting TCP connections on Sysmon v1.5.1 on Rocky linux 9.7
Open
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 2.2k
- Forks
- 220
- Avg merge
- 11d 22h
- Merged PRs (30d)
- 2
Description
Hi,
I am using Rocky Linux 9.7 (Blue Onyx), kernel: 5.14.0-611.30.1.el9_7.x86_64. I used sysmon on my rocky 8 machine with same config file to log everything and it worked fine. Since I migrated to rocky 9, sysmon event 3 is not picking up TCP network connections only showing upd.
Any help would be appreciated. Thanks
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report on Rocky Linux 9.7 with kernel 5.14.0-611.30.1.el9_7.x86_64, using the same configuration that worked on Rocky Linux 8. Compare Sysmon event 3 handling for TCP and UDP connections; done means TCP connections are detected as well as UDP.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100