Sysmon Tool: Adding outbound TCP checks
The requirement
While sysmon tool remains an excellent inbound monitoring tool to identify the activity on to the server and also identifying the cause for a possible node overage. What it was missing is the outbound connections check - so if there was any outbound connections that would lock off the services then sysmon will have no clue why the services are failing. Found it in a hard way during an outage.
Features so far on Sysmon
So in addition to what we already have in terms of incoming connections, access logs monitoring and IP address inbound listing - the new features like system report and log analyzer was added in.
Latest Feature
The most recent update did include the option to save the logs for all activities through sysmon and also the option to generate a CSV or a html report for client facing side.
Future of Sysmon
Adding the new feature to monitor the syn connections both incoming and outbound and also to setup a mu plugin to the installation so that we can analyze what is causing the issue. This uses ss -tlnp to identify the connections and persistent established connections that is stalling.