sysmon 1.4.0 missing TCP events on RHEL 9
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- linux
- Domain
- networking, operating-systems
Research direction
Start with tracepoint_test.sh and tracepoint_test_output.txt, then compare the RHEL 9 results with perf_list.txt and the reported Ubuntu behavior. Reproduce the missing TCP events with sysmon.xml on the stated RHEL kernel; done means TCP events are logged while UDP events continue to work.
Written by the indexing model from the issue text.
Description
Issue:
I have Sysmon installed on a RHEL 9 server and it is failing to log any TCP events. UDP events log fine. I am testing with a wide open sysmon config (attached). I've tested the same configuration on Ubuntu 24.04.3 LTS with no issues.
I have attached the output of a tracepoint test that I ran, the shell script used, and also the perf list output showing sysmon attached to inet_sock_set_state.
Sysmon Version
1.4.0
OS/kernel version
RHEL 9.6 (Plow)
5.14.0-611.9.1.el9_7.x86_64
- Dominant language
- C
- Stars
- 2.2k
- Forks
- 220
- Avg merge
- 11d 22h
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/SysmonForLinux
-
microsoft/SysmonForLinux#238 · 1 assignee ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
microsoft/SysmonForLinux#233 ·
-
microsoft/SysmonForLinux#230 · 1 assignee ·
-
microsoft/SysmonForLinux#226 · 1 assignee ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
microsoft/SysmonForLinux#220 · 2 reactions ·
All issues in microsoft/SysmonForLinux
Similar issues
-
internal.h中，漏掉了1个定义。 Open
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
kovidgoyal/kitty#10516 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 80/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
zephyrproject-rtos/zephyr#120011 ·