Sysmon event 3 is not detecting TCP connections on Sysmon v1.5.1 on Rocky linux 9.7

Open

#233 opened on Apr 24, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Quiet
Tech stack: linux
Domain: operating-systems

Research direction

Reproduce the report on Rocky Linux 9.7 with kernel 5.14.0-611.30.1.el9_7.x86_64, using the same configuration that worked on Rocky Linux 8. Compare Sysmon event 3 handling for TCP and UDP connections; done means TCP connections are detected as well as UDP.

Written by the indexing model from the issue text.

Description

Hi,

I am using Rocky Linux 9.7 (Blue Onyx), kernel: 5.14.0-611.30.1.el9_7.x86_64. I used sysmon on my rocky 8 machine with same config file to log everything and it worked fine. Since I migrated to rocky 9, sysmon event 3 is not picking up TCP network connections only showing upd.

Any help would be appreciated. Thanks

Dominant language: C
Stars: 2.2k
Forks: 220
Avg merge: 11d 22h
Merged PRs (30d): 2

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

internal.h中，漏掉了1个定义。 Open

Difficulty 1/5 Under an hour Newbie friendliness 95/100

microsoft/mimalloc#1414 · 1 reaction · Opened Sep 23, 2026
Inline assembly tests use 32-bit mnemonic suffixes on platform-`int` operands, so they fail to assemble under gcc/clang Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

vlang/v#28870 · Opened Sep 23, 2026
Broadcast Documentation Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

kovidgoyal/kitty#10516 · Opened Sep 22, 2026
install_library_dev fails on a fresh prefix under the forced -j 8 macOS 27 Open

Difficulty 1/5 Under an hour Newbie friendliness 80/100

hashcat/hashcat#4907 · Opened Sep 22, 2026
kernel: shared_multi_heap: no internal locking, causes heap corruption with CONFIG_ESP_WIFI_HEAP_SPIRAM=y (ppTask vs wpa_supplicant race) Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

zephyrproject-rtos/zephyr#120011 · Opened Sep 22, 2026

More C issues