Re: Sysmon dying
Richard van Katwijk <[email protected]> Thu, 31 Mar 2011 23:36:31 +0200
| Newsgroups | gmane.comp.monitoring.sysmon.help |
|---|---|
| Message-ID | <[email protected]> |
--===============0932494986== Content-Type: multipart/alternative; boundary=0016e6dab1863123b1049fce165d --0016e6dab1863123b1049fce165d Content-Type: text/plain; charset=ISO-8859-1 Ah, hang on: root@foreman /tmp # ulimit -a core file size (blocks, -c) 0 .... root@foreman /tmp # ulimit -c unlimited root@foreman /tmp # ulimit -a core file size (blocks, -c) unlimited ..... Lets see :) Live and learn. On 31 March 2011 23:33, Richard van Katwijk <[email protected]> wrote: > This article contains some detail on when a core file may not be produced: > http://manpages.ubuntu.com/manpages/intrepid/man5/core.5.html > > I have been through each, and none should be the cause in my case. > > I have now started sysmon as root (the usual) in /tmp - lets see what it > does..... > > > > On 31 March 2011 23:08, Richard van Katwijk <[email protected]>wrote: > >> :( >> >> root@foreman ~ # ulimit >> unlimited >> root@foreman ~ # ls /*core* >> ls: cannot access /*core*: No such file or directory >> root@foreman ~ # ls /root/*core* >> ls: cannot access /root/*core*: No such file or directory >> ---- >> >> no 'limit' on ubuntu, i guess ulimit is right? >> also did a 'find' for *core* - nothing :( >> >> >> >> On 31 March 2011 23:00, Jared Mauch <jared-li9M/[email protected]> wrote: >> >>> can you send the output of 'limit' and ls /*core* and ls /root/*core* >>> >>> - Jared >>> >>> On Mar 31, 2011, at 4:56 PM, Richard van Katwijk wrote: >>> >>> > I cannot seem to find any core dump. I get: >>> > >>> > sysmond: 21:19:20 about to abort and dump core (i think in /) >>> > >>> > but cant find anything there. Any hints as to what the core file may be >>> named or where it may be? >>> > >>> > >>> > On 31 March 2011 17:20, Jared Mauch <jared-li9M/[email protected]> wrote: >>> > gdb /path/to/sysmond /path/to/corefile >>> > >>> > (gdb) where >>> > >>> > - Jared >>> > >>> > On Mar 31, 2011, at 11:19 AM, Richard van Katwijk wrote: >>> > >>> > > Hi Jared, >>> > > >>> > > I am not too familiar with gdb, do i need to run it as gbd sysmond or >>> attach gdb to the process id? Neither seem to give anything useful. >>> > > >>> > > On 31 March 2011 15:30, Jared Mauch <jared-li9M/[email protected]> wrote: >>> > > Can you gdb it and send the output of "where" to me? >>> > > >>> > > Jared Mauch >>> > > >>> > > On Mar 31, 2011, at 7:29 AM, Richard van Katwijk < >>> [email protected]> wrote: >>> > > >>> > >> Hi, has anyone seen this before, or any idea what might cause it? >>> > >> >>> > >> My sysmon instance has been up and running for about a year, this is >>> the second time i am seeing this, though today it happens almost as soon as >>> i restart. >>> > >> >>> > >> Box is running Ubuntu 10.04 LTS and nothing has changed on that box >>> in ages. >>> > >> >>> > >> Richard >>> > >> >>> > >> ================================================================ >>> > >> >>> > >> sysmond: 13:24:01 Starting sysmon v0.92.2 >>> > >> *** stack smashing detected ***: /usr/local/bin/sysmond terminated >>> > >> ======= Backtrace: ========= >>> > >> /lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x50)[0xb775d390] >>> > >> /lib/tls/i686/cmov/libc.so.6(+0xe233a)[0xb775d33a] >>> > >> /usr/local/bin/sysmond[0x8062086] >>> > >> /usr/local/bin/sysmond[0x804ba4d] >>> > >> /usr/local/bin/sysmond[0x804bf15] >>> > >> /usr/local/bin/sysmond[0x804ca8d] >>> > >> /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb7691bd6] >>> > >> /usr/local/bin/sysmond[0x8049a71] >>> > >> ======= Memory map: ======== >>> > >> 08048000-0806c000 r-xp 00000000 08:01 151 >>> /usr/local/bin/sysmond >>> > >> 0806c000-0806d000 r--p 00023000 08:01 151 >>> /usr/local/bin/sysmond >>> > >> 0806d000-0806e000 rw-p 00024000 08:01 151 >>> /usr/local/bin/sysmond >>> > >> 0806e000-08073000 rw-p 00000000 00:00 0 >>> > >> 08900000-08940000 rw-p 00000000 00:00 0 [heap] >>> > >> b7641000-b765e000 r-xp 00000000 08:01 478 /lib/libgcc_s.so.1 >>> > >> b765e000-b765f000 r--p 0001c000 08:01 478 /lib/libgcc_s.so.1 >>> > >> b765f000-b7660000 rw-p 0001d000 08:01 478 /lib/libgcc_s.so.1 >>> > >> b7660000-b7664000 r-xp 00000000 08:01 8150 /lib/tls/i686/cmov/ >>> libnss_dns-2.11.1.so >>> > >> b7664000-b7665000 r--p 00004000 08:01 8150 /lib/tls/i686/cmov/ >>> libnss_dns-2.11.1.so >>> > >> b7665000-b7666000 rw-p 00005000 08:01 8150 /lib/tls/i686/cmov/ >>> libnss_dns-2.11.1.so >>> > >> b766e000-b7678000 r-xp 00000000 08:01 8151 /lib/tls/i686/cmov/ >>> libnss_files-2.11.1.so >>> > >> b7678000-b7679000 r--p 00009000 08:01 8151 /lib/tls/i686/cmov/ >>> libnss_files-2.11.1.so >>> > >> b7679000-b767a000 rw-p 0000a000 08:01 8151 /lib/tls/i686/cmov/ >>> libnss_files-2.11.1.so >>> > >> b767a000-b767b000 rw-p 00000000 00:00 0 >>> > >> b767b000-b77ce000 r-xp 00000000 08:01 8138 /lib/tls/i686/cmov/ >>> libc-2.11.1.so >>> > >> b77ce000-b77cf000 ---p 00153000 08:01 8138 /lib/tls/i686/cmov/ >>> libc-2.11.1.so >>> > >> b77cf000-b77d1000 r--p 00153000 08:01 8138 /lib/tls/i686/cmov/ >>> libc-2.11.1.so >>> > >> b77d1000-b77d2000 rw-p 00155000 08:01 8138 /lib/tls/i686/cmov/ >>> libc-2.11.1.so >>> > >> b77d2000-b77d5000 rw-p 00000000 00:00 0 >>> > >> b77d5000-b77e8000 r-xp 00000000 08:01 8148 /lib/tls/i686/cmov/ >>> libnsl-2.11.1.so >>> > >> b77e8000-b77e9000 r--p 00012000 08:01 8148 /lib/tls/i686/cmov/ >>> libnsl-2.11.1.so >>> > >> b77e9000-b77ea000 rw-p 00013000 08:01 8148 /lib/tls/i686/cmov/ >>> libnsl-2.11.1.so >>> > >> b77ea000-b77ed000 rw-p 00000000 00:00 0 >>> > >> b77ed000-b7802000 r-xp 00000000 08:01 8157 /lib/tls/i686/cmov/ >>> libpthread-2.11.1.so >>> > >> b7802000-b7803000 r--p 00014000 08:01 8157 /lib/tls/i686/cmov/ >>> libpthread-2.11.1.so >>> > >> b7803000-b7804000 rw-p 00015000 08:01 8157 /lib/tls/i686/cmov/ >>> libpthread-2.11.1.so >>> > >> b7804000-b7806000 rw-p 00000000 00:00 0 >>> > >> b7806000-b7816000 r-xp 00000000 08:01 8158 /lib/tls/i686/cmov/ >>> libresolv-2.11.1.so >>> > >> b7816000-b7817000 r--p 00010000 08:01 8158 /lib/tls/i686/cmov/ >>> libresolv-2.11.1.so >>> > >> b7817000-b7818000 rw-p 00011000 08:01 8158 /lib/tls/i686/cmov/ >>> libresolv-2.11.1.so >>> > >> b7818000-b781a000 rw-p 00000000 00:00 0 >>> > >> b7821000-b7824000 rw-p 00000000 00:00 0 >>> > >> b7824000-b7825000 r-xp 00000000 00:00 0 [vdso] >>> > >> b7825000-b7840000 r-xp 00000000 08:01 636 /lib/ld-2.11.1.so >>> > >> b7840000-b7841000 r--p 0001a000 08:01 636 /lib/ld-2.11.1.so >>> > >> b7841000-b7842000 rw-p 0001b000 08:01 636 /lib/ld-2.11.1.so >>> > >> bf86e000-bf883000 rw-p 00000000 00:00 0 [stack] >>> > >> sysmond: 13:24:23 about to abort and dump core (i think in /root) >>> > >> >>> > >> _______________________________________________ >>> > >> Sysmon-help mailing list >>> > >> Sysmon-help-li9M/[email protected] >>> > >> https://puck.nether.net/mailman/listinfo/sysmon-help >>> > > >>> > >>> > >>> >>> >> > --0016e6dab1863123b1049fce165d Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Ah, hang on:<br><br>root@foreman /tmp # ulimit -a<br>core file size=A0=A0= =A0=A0=A0=A0=A0=A0=A0 (blocks, -c) 0<br>....<br><br>root@foreman /tmp # uli= mit -c unlimited<br>root@foreman /tmp # ulimit -a<br>core file size=A0=A0= =A0=A0=A0=A0=A0=A0=A0 (blocks, -c) unlimited<br> .....<br><br>Lets see :) Live and learn.<br><br><br><div class=3D"gmail_quo= te">On 31 March 2011 23:33, Richard van Katwijk <span dir=3D"ltr"><<a hr= ef=3D"mailto:[email protected]">[email protected]</a>></span> = wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0.8ex; borde= r-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">This article cont= ains some detail on when a core file may not be produced:<br><a href=3D"htt= p://manpages.ubuntu.com/manpages/intrepid/man5/core.5.html" target=3D"_blan= k">http://manpages.ubuntu.com/manpages/intrepid/man5/core.5.html</a><br> <br> I have been through each, and none should be the cause in my case.<br><br>I= have now started sysmon as root (the usual) in /tmp - lets see what it doe= s.....<div><div></div><div class=3D"h5"><span style=3D"border-collapse: sep= arate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-s= tyle: normal; font-variant: normal; font-weight: normal; letter-spacing: no= rmal; line-height: normal; text-indent: 0px; text-transform: none; white-sp= ace: normal; word-spacing: 0px;"><span style=3D"border-collapse: separate; = color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: n= ormal; font-variant: normal; font-weight: normal; letter-spacing: normal; l= ine-height: normal; text-indent: 0px; text-transform: none; white-space: no= rmal; word-spacing: 0px;"><span style=3D"border-collapse: separate; color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant: normal; font-weight: normal; letter-spacing: normal; line-hei= ght: normal; text-indent: 0px; text-transform: none; white-space: normal; w= ord-spacing: 0px;"></span></span></span><br> <br><br><div class=3D"gmail_quote">On 31 March 2011 23:08, Richard van Katw= ijk <span dir=3D"ltr"><<a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a>></span> wrote:<br><blockquote cla= ss=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0.8ex; border-left: 1px sol= id rgb(204, 204, 204); padding-left: 1ex;"> :(<br><br>root@foreman ~ # ulimit<br>unlimited<br>root@foreman ~ # ls /*cor= e*<br>ls: cannot access /*core*: No such file or directory<br>root@foreman = ~ # ls /root/*core*<br>ls: cannot access /root/*core*: No such file or dire= ctory<br> ----<br><br>no 'limit' on ubuntu, i guess ulimit is right?<br>also = did a 'find' for *core* - nothing :(<div><div></div><div><br><br><b= r><div class=3D"gmail_quote">On 31 March 2011 23:00, Jared Mauch <span dir= =3D"ltr"><<a href=3D"mailto:jared-li9M/[email protected]" target=3D"_blank">jar= ed-li9M/[email protected]</a>></span> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0.8ex; borde= r-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">can you send the = output of 'limit' and ls /*core* and ls /root/*core*<br> <font color=3D"#888888"><br> - Jared<br> </font><div><div></div><div><br> On Mar 31, 2011, at 4:56 PM, Richard van Katwijk wrote:<br> <br> > I cannot seem to find any core dump. I get:<br> ><br> > sysmond: 21:19:20 about to abort and dump core (i think in /)<br> ><br> > but cant find anything there. Any hints as to what the core file may b= e named or where it may be?<br> ><br> ><br> > On 31 March 2011 17:20, Jared Mauch <<a href=3D"mailto:[email protected]= ether.net" target=3D"_blank">jared-li9M/[email protected]</a>> wrote:<br> > gdb /path/to/sysmond /path/to/corefile<br> ><br> > (gdb) where<br> ><br> > - Jared<br> ><br> > On Mar 31, 2011, at 11:19 AM, Richard van Katwijk wrote:<br> ><br> > > Hi Jared,<br> > ><br> > > I am not too familiar with gdb, do i need to run it as gbd sysmon= d or attach gdb to the process id? Neither seem to give anything useful.<br= > > ><br> > > On 31 March 2011 15:30, Jared Mauch <<a href=3D"mailto:jared@p= uck.nether.net" target=3D"_blank">jared-li9M/[email protected]</a>> wrote:<br> > > Can you gdb it and send the output of "where" to me?<br= > > ><br> > > Jared Mauch<br> > ><br> > > On Mar 31, 2011, at 7:29 AM, Richard van Katwijk <<a href=3D"m= ailto:[email protected]" target=3D"_blank">[email protected]</a>&= gt; wrote:<br> > ><br> > >> Hi, has anyone seen this before, or any idea what might cause= it?<br> > >><br> > >> My sysmon instance has been up and running for about a year, = this is the second time i am seeing this, though today it happens almost as= soon as i restart.<br> > >><br> > >> Box is running Ubuntu 10.04 LTS and nothing has changed on th= at box in ages.<br> > >><br> > >> Richard<br> > >><br> > >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br> > >><br> > >> sysmond: 13:24:01 Starting sysmon v0.92.2<br> > >> *** stack smashing detected ***: /usr/local/bin/sysmond termi= nated<br> > >> =3D=3D=3D=3D=3D=3D=3D Backtrace: =3D=3D=3D=3D=3D=3D=3D=3D=3D<= br> > >> /lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x50)[0xb775d390]= <br> > >> /lib/tls/i686/cmov/libc.so.6(+0xe233a)[0xb775d33a]<br> > >> /usr/local/bin/sysmond[0x8062086]<br> > >> /usr/local/bin/sysmond[0x804ba4d]<br> > >> /usr/local/bin/sysmond[0x804bf15]<br> > >> /usr/local/bin/sysmond[0x804ca8d]<br> > >> /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb7691b= d6]<br> > >> /usr/local/bin/sysmond[0x8049a71]<br> > >> =3D=3D=3D=3D=3D=3D=3D Memory map: =3D=3D=3D=3D=3D=3D=3D=3D<br= > > >> 08048000-0806c000 r-xp 00000000 08:01 151 =A0 =A0 =A0 =A0/usr= /local/bin/sysmond<br> > >> 0806c000-0806d000 r--p 00023000 08:01 151 =A0 =A0 =A0 =A0/usr= /local/bin/sysmond<br> > >> 0806d000-0806e000 rw-p 00024000 08:01 151 =A0 =A0 =A0 =A0/usr= /local/bin/sysmond<br> > >> 0806e000-08073000 rw-p 00000000 00:00 0<br> > >> 08900000-08940000 rw-p 00000000 00:00 0 =A0 =A0 =A0 =A0 =A0[h= eap]<br> > >> b7641000-b765e000 r-xp 00000000 08:01 478 =A0 =A0 =A0 =A0/lib= /libgcc_s.so.1<br> > >> b765e000-b765f000 r--p 0001c000 08:01 478 =A0 =A0 =A0 =A0/lib= /libgcc_s.so.1<br> > >> b765f000-b7660000 rw-p 0001d000 08:01 478 =A0 =A0 =A0 =A0/lib= /libgcc_s.so.1<br> > >> b7660000-b7664000 r-xp 00000000 08:01 8150 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_dns-2.11.1.so" target=3D"_blank">libn= ss_dns-2.11.1.so</a><br> > >> b7664000-b7665000 r--p 00004000 08:01 8150 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_dns-2.11.1.so" target=3D"_blank">libn= ss_dns-2.11.1.so</a><br> > >> b7665000-b7666000 rw-p 00005000 08:01 8150 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_dns-2.11.1.so" target=3D"_blank">libn= ss_dns-2.11.1.so</a><br> > >> b766e000-b7678000 r-xp 00000000 08:01 8151 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_files-2.11.1.so" target=3D"_blank">li= bnss_files-2.11.1.so</a><br> > >> b7678000-b7679000 r--p 00009000 08:01 8151 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_files-2.11.1.so" target=3D"_blank">li= bnss_files-2.11.1.so</a><br> > >> b7679000-b767a000 rw-p 0000a000 08:01 8151 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_files-2.11.1.so" target=3D"_blank">li= bnss_files-2.11.1.so</a><br> > >> b767a000-b767b000 rw-p 00000000 00:00 0<br> > >> b767b000-b77ce000 r-xp 00000000 08:01 8138 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.= 1.so</a><br> > >> b77ce000-b77cf000 ---p 00153000 08:01 8138 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.= 1.so</a><br> > >> b77cf000-b77d1000 r--p 00153000 08:01 8138 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.= 1.so</a><br> > >> b77d1000-b77d2000 rw-p 00155000 08:01 8138 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.= 1.so</a><br> > >> b77d2000-b77d5000 rw-p 00000000 00:00 0<br> > >> b77d5000-b77e8000 r-xp 00000000 08:01 8148 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnsl-2.11.1.so" target=3D"_blank">libnsl-2= .11.1.so</a><br> > >> b77e8000-b77e9000 r--p 00012000 08:01 8148 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnsl-2.11.1.so" target=3D"_blank">libnsl-2= .11.1.so</a><br> > >> b77e9000-b77ea000 rw-p 00013000 08:01 8148 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnsl-2.11.1.so" target=3D"_blank">libnsl-2= .11.1.so</a><br> > >> b77ea000-b77ed000 rw-p 00000000 00:00 0<br> > >> b77ed000-b7802000 r-xp 00000000 08:01 8157 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libpthread-2.11.1.so" target=3D"_blank">libp= thread-2.11.1.so</a><br> > >> b7802000-b7803000 r--p 00014000 08:01 8157 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libpthread-2.11.1.so" target=3D"_blank">libp= thread-2.11.1.so</a><br> > >> b7803000-b7804000 rw-p 00015000 08:01 8157 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libpthread-2.11.1.so" target=3D"_blank">libp= thread-2.11.1.so</a><br> > >> b7804000-b7806000 rw-p 00000000 00:00 0<br> > >> b7806000-b7816000 r-xp 00000000 08:01 8158 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libresolv-2.11.1.so" target=3D"_blank">libre= solv-2.11.1.so</a><br> > >> b7816000-b7817000 r--p 00010000 08:01 8158 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libresolv-2.11.1.so" target=3D"_blank">libre= solv-2.11.1.so</a><br> > >> b7817000-b7818000 rw-p 00011000 08:01 8158 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libresolv-2.11.1.so" target=3D"_blank">libre= solv-2.11.1.so</a><br> > >> b7818000-b781a000 rw-p 00000000 00:00 0<br> > >> b7821000-b7824000 rw-p 00000000 00:00 0<br> > >> b7824000-b7825000 r-xp 00000000 00:00 0 =A0 =A0 =A0 =A0 =A0[v= dso]<br> > >> b7825000-b7840000 r-xp 00000000 08:01 636 =A0 =A0 =A0 =A0/lib= /<a href=3D"http://ld-2.11.1.so" target=3D"_blank">ld-2.11.1.so</a><br> > >> b7840000-b7841000 r--p 0001a000 08:01 636 =A0 =A0 =A0 =A0/lib= /<a href=3D"http://ld-2.11.1.so" target=3D"_blank">ld-2.11.1.so</a><br> > >> b7841000-b7842000 rw-p 0001b000 08:01 636 =A0 =A0 =A0 =A0/lib= /<a href=3D"http://ld-2.11.1.so" target=3D"_blank">ld-2.11.1.so</a><br> > >> bf86e000-bf883000 rw-p 00000000 00:00 0 =A0 =A0 =A0 =A0 =A0[s= tack]<br> > >> sysmond: 13:24:23 about to abort and dump core (i think in /r= oot)<br> > >><br> > >> _______________________________________________<br> > >> Sysmon-help mailing list<br> > >> <a href=3D"mailto:Sysmon-help-li9M/[email protected]" target=3D"_bla= nk">Sysmon-help-li9M/[email protected]</a><br> > >> <a href=3D"https://puck.nether.net/mailman/listinfo/sysmon-he= lp" target=3D"_blank">https://puck.nether.net/mailman/listinfo/sysmon-help<= /a><br> > ><br> ><br> ><br> <br> </div></div></blockquote></div><br> </div></div></blockquote></div><br> </div></div></blockquote></div><br> --0016e6dab1863123b1049fce165d-- --===============0932494986== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sysmon-help mailing list Sysmon-help-li9M/[email protected] https://puck.nether.net/mailman/listinfo/sysmon-help --===============0932494986==--