I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests.

Sysmon appears to be capturing all other Event ID's except for 22. I have installed this on a 2012 box with the same .xml configuration file and 22 is being happily logged.

Has anyone else noticed the same on a Windows 2008 box?

1 Answer 1


According to Sysmon Documentation,

Event ID 22: DNSEvent (DNS query)

This event generates when a process executes a DNS query, whether the result is successful or fails, cached or not. The telemetry for this event was added for Windows 8.1 so it is not available on Windows 7 and earlier.

This explains why you don't see event 22: Windows Server 2008 R2 and Windows 7 share the same version number 6.1, whereas the equivalent for Windows 8.1 is Windows Server 2012 R2 (version 6.3).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.