{"id":20928358,"url":"https://github.com/microsoft/SysmonForLinux","last_synced_at":"2025-05-13T18:32:07.062Z","repository":{"id":37642858,"uuid":"308092559","full_name":"microsoft/SysmonForLinux","owner":"microsoft","description":"Sysmon for Linux","archived":false,"fork":false,"pushed_at":"2024-11-15T17:10:21.000Z","size":6769,"stargazers_count":1746,"open_issues_count":30,"forks_count":185,"subscribers_count":54,"default_branch":"main","last_synced_at":"2024-11-15T18:21:08.115Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/microsoft.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-10-28T17:30:25.000Z","updated_at":"2024-11-15T17:10:25.000Z","dependencies_parsed_at":"2024-03-21T16:28:54.846Z","dependency_job_id":"a51f5480-e490-4b52-92be-d6101288a380","html_url":"https://github.com/microsoft/SysmonForLinux","commit_stats":null,"previous_names":["microsoft/sysmonforlinux"],"tags_count":8,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FSysmonForLinux","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FSysmonForLinux/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FSysmonForLinux/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FSysmonForLinux/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/microsoft","download_url":"https://codeload.github.com/microsoft/SysmonForLinux/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224869696,"owners_count":17383423,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-18T21:01:02.614Z","updated_at":"2024-11-18T21:03:00.120Z","avatar_url":"https://github.com/microsoft.png","language":"C","funding_links":[],"categories":["Other Lists","HarmonyOS","C"],"sub_categories":["🧪 LAB","Windows Manager"],"readme":"[![Build Status](https://dev.azure.com/sysinternals/Tools/_apis/build/status/Sysinternals.SysmonForLinux?repoName=Sysinternals%2FSysmonForLinux\u0026branchName=main)](https://dev.azure.com/sysinternals/Tools/_build/latest?definitionId=340\u0026repoName=Sysinternals%2FSysmonForLinux\u0026branchName=main)\n\n# Sysmon for Linux\nSysmon for Linux is a tool that monitors and logs system activity including process lifetime, network connections, file system writes, and more. Sysmon works across reboots and uses advanced filtering to help identify malicious activity as well as how intruders and malware operate on your network.\nSysmon for Linux is part of [Sysinternals](https://sysinternals.com).\n\n![Sysmon in use](sysmon.gif \"Sysmon in use\")\n\n## Installation\nThe packages are available in the official Microsoft Linux repositories and instructions on how to install the packages for the different Linux distributions can be found in the [Installation instructions](INSTALL.md).\n\nThis project contains the code for build and installing [Sysmon](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon) on Linux.\n\n## Build\nPlease see build instructions [here](BUILD.md).\n\n## Autodiscovery of Offsets\nOn systems that are BTF enabled, Sysmon will use BTF for accurate kernel offsets.\nSysmon also supports specifying standalone BTF files (using /BTF switch). There are\nseveral ways to generate BTF files and [BTFHub](https://github.com/aquasecurity/btfhub)\nhas a number of standalone BTF files for different distributions/kernels.\n\nIf BTF isn't available, Sysmon attempts to automatically discover the offsets of some\nmembers of some kernel structs. If this fails, please provide details of the kernel\nversion (and config if possible) plus the error message to the GitHub issues page.\n\nYou can then generate a configuration file to override the autodiscovery by\nbuilding the getOffsets module in the /opt/sysinternals/getOffsets directory.\nSee the README.md in that directory for more information.\n\n## Manual Page\nA man page for Sysmon can be found in the package directory, and is installed\nby both deb and rpm packages.\n\nUse 'find' on the package directory to locate it manually.\n\n## Output\n```\nsudo tail -f /var/log/syslog\n```\nor more human-readable\n```\nsudo tail -f /var/log/syslog | sudo /opt/sysmon/sysmonLogView\n```\n\nSysmonLogView has options to filter the output to make it easy to identify\nspecific events or reduce outputted fields for brevity.\n\nSysmonLogView is built when Sysmon is built and is installed into /opt/sysmon\nwhen sysmon is installed.\n\n*Important*: You may wish to modify your Syslogger config to ensure it can\nhandle particularly large events (e.g. \u003e64KB, as defaults are often between 1KB\nand 8KB), and/or use the FieldSizes configuration entry to limit the length of\noutput for some fields, such as CommandLine, Image, CurrentDirectory, etc.\n\nExample:\n\nAdd \\\u003cFieldSizes\\\u003eCommandLine:100,Image:20\\\u003c/FieldSizes\\\u003e under\n\\\u003cSysmon\\\u003e in your configuration file.\n\n## Developer Details\nSee DEVELOP.md\n\n## License\nSysmon For Linux is licensed under MIT, with the eBPF programs licensed under\nGPL2.  SysinternalsEBPF (on which Sysmon For Linux depends) is licensed under\nLGPL2.1, with the eBPF code library licensed under GPL2.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmicrosoft%2FSysmonForLinux","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmicrosoft%2FSysmonForLinux","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmicrosoft%2FSysmonForLinux/lists"}