[Sysmon 15.12] Server crashes from time to time with Sysmon v15.12

Joe Doe 156

We had a crash after 20 minutes of the installation of Sysmon 15.12. In the system event log we've found this message: The computer has rebooted from a bugcheck. The bugcheck was: 0x00000139 (0x0000000000000003, 0xffff928901305000, 0xffff928901304f58, 0x0000000000000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP error - Copy

@Alex Mihaiuc

Alex Mihaiuc 176 Reputation points Microsoft Employee

2024-02-06T07:28:08.0033333+00:00

Can you share that memory dump file? The email address is my name (with a dot between the words).
BT-5176 0 Reputation points

2024-02-06T08:15:56.7533333+00:00

Have the same problem on multiple VMs after deploying sysmon 15.12 0x00000139 KERNEL_SECURITY_CHECK_FAILURE ntoskrnl.exe Parameter 1 = 3 A LIST_ENTRY was corrupted 020424-8828-01.dmp.txt
Nick Evs 0 Reputation points

2024-02-06T09:25:36.17+00:00
The error you're encountering, indicated by the bugcheck code 0x00000139 with the parameters you've provided, suggests a KERNEL_SECURITY_CHECK_FAILURE. This error typically points to a kernel corruption, which could have been caused by a driver conflict, memory corruption, or other system-level errors. Given this occurred after installing Sysmon (System Monitor) version 15.12, it's possible the crash might be related to the installation or the operation of Sysmon itself, or an interaction between Sysmon and other system components or drivers.

To resolve this issue, here are some steps you can follow:

Update or Roll Back Drivers: If the memory dump analysis points to a specific driver as the cause, updating that driver to the latest version or rolling back to a previous stable version can resolve the issue.

Check for Updates: Ensure that your Windows operating system and all drivers are up to date. Sometimes, compatibility issues are resolved in newer versions of software and drivers.

Sysmon Configuration: Review the Sysmon configuration file for any settings that might be overly aggressive or incompatible with your system's configuration. Sysmon is highly customizable, and certain configurations might inadvertently cause system instability.

Reinstall or Update Sysmon: If Sysmon itself is causing the issue, consider reinstalling it or updating to a newer version if available. There might be bug fixes in newer versions that address the issue you're experiencing.

System File Checker (SFC) and Check Disk (CHKDSK): Run the System File Checker tool to repair missing or corrupted system files. You can do this by opening Command Prompt as an administrator and running the command sfc /scannow. Additionally, run chkdsk /f to check the disk for errors and fix them automatically.

Event Viewer and Reliability Monitor: Check the Event Viewer for other related error messages that might give more clues. The Reliability Monitor can also provide insights into system stability issues and other critical events leading up to the crash.

Safe Mode: Try running your system in Safe Mode to see if the issue persists. If the system is stable in Safe Mode, it's likely that third-party drivers or software are causing the issue.

Remember, making system changes can have unintended consequences. It's always a good idea to back up important data before making significant modifications to your system.
Pavel Štádler 0 Reputation points

2024-02-09T06:27:37.79+00:00

Also experinced BSOD on Win2016 with SYSMON driver (15.12). I can provide dump (36GB) or export from WinDBg ... Pavel Štádler
Pavel Štádler 0 Reputation points

2024-02-09T09:49:10.52+00:00

My email: pavel.stadler@cnb.cz

4 answers

Joe Doe 156 Reputation points

2024-02-13T20:23:53.0966667+00:00

Sysmon v15.14 is out now: https://techcommunity.microsoft.com/t5/sysinternals-blog/sysmon-v15-14/ba-p/4056285

This update to Sysmon resolves a service crash on configuration change and a rare system crash.
Please sign in to rate this answer.

2 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Alex Mihaiuc 176 Reputation points Microsoft Employee

2024-02-09T09:53:00.1833333+00:00

Thanks Pavel, messaging you.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
MatthewBrown-1493 0 Reputation points

2024-02-13T00:19:26.16+00:00

text
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Mikey 0 Reputation points

2024-03-12T01:04:58.77+00:00

@Alex Mihaiuc **
Does 15.14 specifically fix the crash mentioned in this thread? We are seeing similar issues on 15.12Thank you.
Please sign in to rate this answer.
Alex Mihaiuc 176 Reputation points Microsoft Employee

2024-03-12T08:41:38.2866667+00:00

@Mikey if it's the one @BT-5176 saw, yes.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

[Sysmon 15.12] Server crashes from time to time with Sysmon v15.12

4 answers

Your answer