EventID=3 Source and DestinationHostname not resolved?

Open

#186 opened on Oct 7, 2024 0 comments 1 reaction 1 assignee View on GitHub

@MarioHewardt is already working on this.

Since Oct 7, 2024.

Assessment

This issue has not been assessed yet.

Description

investigate

Describe the bug
We are not able to resolve SourceHostname and DestinationHostname in Evt.3 the same way it is done in Sysmon for Windows..

have tried to add true to the .xml but the log only shows "-"
All IP's are manually resolvable from the OS

To Reproduce
Look for Source and destination hostname in EventID=3 ?

Sysmon version
Version 1.3.3

Distro/kernel version
Red Hat Enterprise Linux 8.10 (Ootpa)
Ubuntu 20.04.6 LTS

Sysmon configuration
Since DNS lookup should (in the windows version at least) be enabled by default..?
have also tried with true with no result.

Logs
Oct 7 16:32:19 Server1 sysmon[1569566]: 354300x80000000000000001106903Linux-Sysmon/Operationalserver1.domain.local-2024-10-07 14:32:19.673{c30c9345-59f2-6703-b805-bfc8d8550000}2898441+/usr/libexec/sssd/sssd_berootudpfalsefalse10.1.1.1-53-false10.2.2.2-47348-

Expected behavior
Sysmon should resolve hostname from IP and place result i log..
Like:
10.1.1.1Server1.domain.local53-false10.2.2.2Server2.domain.local47348-

Additional context

Dominant language: C
Stars: 2.2k
Forks: 220
Avg merge: 11d 22h
Merged PRs (30d): 2

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Broadcast Documentation Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

kovidgoyal/kitty#10516 · Opened Sep 22, 2026
[libc] Implement mknodat in sys/stat Open

libc

Difficulty 2/5 1-2 days Newbie friendliness 76/100

llvm/llvm-project#225506 · 1 comment · Opened Sep 22, 2026
doltlite_vtab_vc_matrix.sh asserts the pre-merge state after a clean merge, so a refused merge passes Open

enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

dolthub/doltlite#3163 · Opened Sep 22, 2026
SOCK_FIONREAD/SOCK_FIONBIO/SOCK_FIOASYNC encoded as sizeof(u_long) — the value depends on the host data model Open

Status: Waiting triage Type: Bug

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

nanoframework/Home#1857 · Opened Sep 22, 2026
A function-call exponent (`A^sqrt(n)`) emits `pow(A, sqrt)(n)` — valid BNGL that codegen cannot compile Open

bug

Difficulty 2/5 Half a day Newbie friendliness 82/100

lanl/bngsim#657 · Opened Sep 22, 2026

More C issues