Process Monitor 2.0 for Linux and Sysmon v15.15

AuSecOps the "255" error is a catch-all for "too serious to be able to silently recover" errors. That 0x40000 report signifies that the system is out of memory - failure to allocate 256 kilobytes. Drop me a private message here with the different occurrences of event 255, I can verify each one individually.

We have been battling with a Sysmon Error #255 for almost a year now, across various recent versions.

Large network, 5000+ hosts, the issue seems to affect about 5% of our fleet occasionally.

We will see Error 255: Failed to allocate 40000 bytes. Exit process.

After this, logs stop flowing and the system needs to be rebooted. Restarting the process/service without a reboot is impossible. We tried everything to figure out what is causing this error but I am out of ideas. On some occasions we need to delete all the registry artifacts for Sysmon and perform a full un-install/re-install before we can get logs flowing to our SIEM again.

Can Microsoft provide some kind of documentation for the wide array of 255 errors, this '40000 bytes' is just one variant, there are many different 255 errors, some of them are sort of self explanatory but many, like this error make absolutely no sense, nor is there any way to debug what is causing it.

How can we get in contact with someone to help try and debug this issue ? Are there any debug steps we can use ourself that arent documented ?

Alex_Mihaiuc Possibly, If I can get it through change control. 

Ian_B1066 the FileDelete*, FileBlockShredding and FileBlockExecutable rules tend to be the most "expensive". Do you have an opportunity to test without those?

Alex_Mihaiuc thank you for your quick reply.

The problem I'm getting is nearly half a gig of them generated on a clustered file server when moving the file server role to that cluster member. It does rather drown out the logging and I don't see a way to prevent it in the config.

Hey Ian_B1066

Those errors are there to inform you about Sysmon being "blind" (due to system load) to some events happening in the system. There's a good chance that the events were also dropped before Sysmon had the functionality to make these reports.

Are the fixes in Sysmon 15.15 likely to address the "Events dropped from driver queue" error 255's I'm seeing with Sysmon 15.14?