Issues

• ProcessTerminate events intermittently report an unrelated user's UID instead of the terminating process's UID

  microsoft/Sysmon-Linux#238 · Filter by author ipduffy opened on Jul 22, 2026
  

• Sysmon event 3 is not detecting TCP connections on Sysmon v1.5.1 on Rocky linux 9.7

  microsoft/Sysmon-Linux#233 · Filter by author FarhamandKhan opened on Apr 24, 2026

• fix: prevent division by zero in intHandler when no events received

  microsoft/Sysmon-Linux#230 · Filter by author logesh-GIT001 opened on Apr 4, 2026
  

• Config is lost after update to 1.5

  microsoft/Sysmon-Linux#226 · Filter by author BE-peac opened on Feb 20, 2026
  

• Request: Official support for Debian 13 (Trixie)

  microsoft/Sysmon-Linux#220 · Filter by author abhiz23 opened on Jan 13, 2026

• Libxml2 Compatibility Issue in Ubuntu 25.10

  microsoft/Sysmon-Linux#219 · Filter by author albrecd opened on Dec 6, 2025
  1

  

• sysmon 1.4.0 missing TCP events on RHEL 9

  microsoft/Sysmon-Linux#218 · Filter by author DeadCanary opened on Nov 26, 2025

• High CPU usage seen for sysmon process

  microsoft/Sysmon-Linux#217 · Filter by author MohakSharma00 opened on Nov 24, 2025

• INSTALL.md file provides wrong commands for Fedora

  microsoft/Sysmon-Linux#216 · Filter by author kittyconf opened on Jul 26, 2025
  

• Memory leaks with sysmon 1.3.7

  investigate
  microsoft/Sysmon-Linux#211 · Filter by author 0xC0FFEEEE opened on Jun 10, 2025
  3

  

• Event Type 3: Incorrect Port Reported

  investigate
  microsoft/Sysmon-Linux#203 · Filter by author albrecd opened on Apr 20, 2025
  1

  

• Fedora-version of sysmonforlinux is failing (made for RHEL 8?)

  investigate
  microsoft/Sysmon-Linux#201 · Filter by author karekaa opened on Apr 2, 2025
  1

  

• Event ID 11 Not Recorded.

  investigate
  microsoft/Sysmon-Linux#190 · Filter by author sjt17053 opened on Dec 25, 2024

• EventID=3 Source and DestinationHostname not resolved?

  investigate
  microsoft/Sysmon-Linux#186 · Filter by author Niklas-PDA opened on Oct 7, 2024
  

• Disable auto rewriting of files

  investigate
  microsoft/Sysmon-Linux#184 · Filter by author juju4 opened on Aug 24, 2024
  4

  

• Request: Implement Event ID 22 (DNSEvent)

  investigate
  microsoft/Sysmon-Linux#183 · Filter by author Y2hlZXNl opened on Aug 14, 2024
  

• FileCreate event

  microsoft/Sysmon-Linux#182 · Filter by author aminassadi opened on Jun 28, 2024
  

• Add BPF_MAP_FREEZE to perf_event output maps to prevent easily blinding of sysmon

  investigate
  microsoft/Sysmon-Linux#180 · Filter by author beaubelgrave opened on Jun 17, 2024
  

• cross compilation support

  enhancement
  microsoft/Sysmon-Linux#154 · Filter by author Jiahao0 opened on Oct 26, 2023
  3

  

• Event ID 11 - Empty TargetFilename

  bug
  microsoft/Sysmon-Linux#153 · Filter by author DodoK94 opened on Oct 23, 2023
  2

  

• Event 3 connections with UDP report Destination IP as 127.0.0.1

  bug
  microsoft/Sysmon-Linux#126 · Filter by author tmccurry-whiskerlabs opened on May 16, 2023
  

• Sysmon should remove the extraced binaries under /opt/sysmon when uninstalling using -u switch

  bug
  microsoft/Sysmon-Linux#106 · Filter by author MarioHewardt opened on Mar 16, 2023

• sourcehostname always empty

  bug
  microsoft/Sysmon-Linux#89 · Filter by author apollocomposable opened on Dec 21, 2022

• ProcessGUIDs are not necessarily unique, especially for non-PIEs

  investigate
  microsoft/Sysmon-Linux#84 · Filter by author inickles opened on Sep 27, 2022

• Lack of error checking on calls to UTF8toUTF16, rule filter bypass

  investigate
  microsoft/Sysmon-Linux#83 · Filter by author inickles opened on Sep 27, 2022