question

M3lon avatar image
1 Vote"
M3lon asked foxmsft answered

Sysmon 13.02 crash when installing specifying a custom configuration on a clean computer

Hi,

We identified that when installing Sysmon 13.02 on a clean computer (no previous Sysmon installation) specifying a custom configuration with -i config.xml, the installation crash silently but a crash log is generated in the Application log and Sysmon is not installed:

Faulting application name: sysmon64_13.02.exe, version: 13.0.2.0, time stamp: 0x60590c93
Faulting module name: sysmon64_13.02.exe, version: 13.0.2.0, time stamp: 0x60590c93
Exception code: 0xc0000409
Fault offset: 0x000000000015d68f
Faulting process id: 0x654
Faulting application start time: 0x01d727c08f00bca7
Faulting application path: Z:\sysmon64_13.02.exe
Faulting module path: Z:\sysmon64_13.02.exe
Report Id: c6519b5d-a1fa-4f2a-ae64-06d886bc1695
Faulting package full name:
Faulting package-relative application ID:

Here is the console output:

PS C:\Windows\system32> z:\sysmon64_13.02.exe -i z:\config.xml


System Monitor v13.02 - System activity monitor
Copyright (C) 2014-2021 Mark Russinovich and Thomas Garnier
Using libxml2. libxml2 is Copyright (C) 1998-2012 Daniel Veillard. All Rights Reserved.
Sysinternals - www.sysinternals.com

We observed this behavior on Windows 2012R2, 2019 and Windows 10 pro.

Installing with -i config.xml -accepteula or without specifying any configuration works well. The issue seems to be related to the EULA popup.
Many thanks in advance for your help.

windows-sysinternals-sysmon
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

One thing that jumps out at me is your path to sysmon.exe having drive letter z. I would have used the installed version of sysmon to merge the config. Do you get the same crash when you merge your config via c:\windows\sysmon.exe?

Are you comfortable sharing your config? It would be good to know which monitors you have enabled, which schema version your config is expressed in, and whether you are using compound rules in your config.

This is a script I use to help summarize a current config in the above terms.


0 Votes 0 ·

1 Answer

foxmsft avatar image
0 Votes"
foxmsft answered

I'm curious whether sysmon itself is trying to actually show its EULA dialog inside a background session on the machines in question. After launching, can you see the process hanging there? Can you also inspect the session it's running in?

Here's what that Session column looks like in Process Explorer
87883-image.png

Right click on the column headers, click "Select Columns..." -> "Process Image" -> "Session". You might have to drag that column around, as it's generally added to the right side of the view.



image.png (54.9 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.