none
Possible Sysmon Bug On Windows 7 & Windows Server 2008 R2 RRS feed

  • Question

  • Hi,

    We believe we have encountered a bug in Sysmon on Windows 7 & Windows Server 2008 R2.

    When using ImageLoad filters to log loading of dlls, Sysmon logs thousands of repetitive ImageLoad events per second where the Loaded Image or Image (loading image) fields contain sysmon.exe.

    The outcome of this is very high cpu usage which renders the machine unusable until sysmon is deactivated or configuration is updated to exclude sysmon.exe related ImageLoad events.

    We have seen people discuss this issue since sysmon 2.0 (https://social.technet.microsoft.com/Forums/windows/en-US/8ffce6b1-7c5c-409e-96c1-4869fa8ad9d7/sysmon-loading-into-svchost-millions-of-times?forum=miscutils).

    Hoping to get some information about where this issue originated from and how to solve it.

    Thanks!

    Sunday, November 18, 2018 1:48 PM

All replies

  • Hello

    could you contact me offline at sysmonsupport@microsoft.com and I will try to help you figure out what is going on.

    MarkC (MSFT)

    Thursday, November 29, 2018 1:22 AM
  • Hello

    we have recently found and resolved this. We will be publishing an update shortly but in the interim anybody who is experiencing this or related issue (significant performance degradation, excessive memory consumption handle leaks etc)  can contact me offline at sysmonsupport@microsoft.com and I can provide them with a copy.

    Regards

    MarkC (MSFT)


    • Edited by markc(msft) Saturday, December 1, 2018 5:21 PM
    Saturday, December 1, 2018 5:21 PM
  • The updated version is now available on our livesite at https://live.sysinternals.com. 

    MarkC(MSFT)

    Friday, December 7, 2018 6:58 PM
  • Hello,

    Sorry for not responding, I was offline for a while.

    We were very happy to see the new version release, we will check it out and let you know if there are any further issues.

    Thank you for very much for your help.

    Boaz


    • Edited by bo_wa Sunday, December 16, 2018 8:18 AM
    Thursday, December 13, 2018 2:26 PM
  • Hi,

    After performing some test on the new version, I have encountered some issues.

    On a physical Windows 10 (17134), virtual (VMware) Windows Server 2008 R2 Datacenter (Build 7601, SP1) machines, both with Sysmon 8.0 installed, attempting to uninstall the old version (8.0) with the new version (8.02) executable caused a Blue Screen Of Death. After a reboot, the 8.02 executable was able to uninstall the 8.0 sysmon.

    On a virtual (VMware) Windows 8.1 (9600) machine, uninstalling the old (8.0) sysmon with the new (8.02) executable was successful, although a bit slow (took about 60 seconds). Attempting to install the new (8.02) sysmon after that, resulted in a BSOD as well. After the BSOD, I managed to install the new (8.02) version.

    Besides that, after the new version was installed on all three machines, it seems that the original issue is in fact resolved, and LoadImage events are registered without any issues.

    Thank you again for everything, and am hoping to hear back from you regarding the BSOD issue

    Boaz


    • Edited by bo_wa Monday, December 17, 2018 10:44 AM
    Monday, December 17, 2018 10:40 AM
  • Boaz

    Do you have a memory dump from the BSOD. If so could you contact me offline at sysmonsupport@microsoft.com ASAP and I will take a look.

    Regards

    MarkC

    Monday, December 17, 2018 6:29 PM
    1. 谢谢

    秦奴奎

    Wednesday, December 19, 2018 5:57 AM
  • Windows Server 2008 R2的Sysmon安装错误

    秦奴奎

    Wednesday, October 16, 2019 9:16 AM