Event ID 11 Not Recorded.

Open
#190 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
c, linux
Domain
operating-systems, security

Research direction

Start by reproducing the report on Oracle Linux 9.5 using the attached test_sysmon.txt configuration and compare the resulting logs with the expected File Creation Event ID 11 behavior. Confirm whether creating files produces Event ID 11, and document the conditions or evidence that explain the observed result.

Written by the indexing model from the issue text.

Description

investigate

I recently installed sysmon on Oracle 9.5 and have monitored the logs generated on a Test Machine. I have not seen or been able to trigger events related to File Creation Event ID 11. I've included the config file I used and the screenshot of the logs.

Image

test_sysmon.txt

Dominant language
C
Stars
2.2k
Forks
220
Avg merge
11d 22h
Merged PRs (30d)
2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/SysmonForLinux

All issues in microsoft/SysmonForLinux

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.