search

Sysinternals / SysmonForLinux

MIT License
1.68k stars 180 forks source link

/opt/sysmon gets removed on upgrade in RHEL8/RHEL9/Ubuntu20.04 #177

Open havokoc opened 1 month ago

havokoc commented 1 month ago

Describe the bug The directory /opt/sysmon gets removed when upgrading the rpm and deb to a newer version. This means that the service cannot start again after an upgrade unless the configuration file is re-installed.

To Reproduce yum upgrade sysmon apt upgrade sysmon

Sysmon version Initial version: 1.3.2 Upgraded version: 1.3.3

Distro/kernel version Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Ubuntu 20.04

Expected behavior The service should start up with the currently running configuration on the upgraded version of sysmon

Additional context Is it possible to add a check in the post-install sections to only run the removal if it's a new install? https://github.com/Sysinternals/SysmonForLinux/blob/main/package/SPECS.in/spec.in https://github.com/Sysinternals/SysmonForLinux/blob/main/package/DEBIAN/postrm

There seems to be flags you can use to check if it's the package is being freshly installed or upgraded. https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/

https://askubuntu.com/a/102128 https://manpages.debian.org/unstable/dpkg-dev/deb-postrm.5.en.html#old-postrm

If removal of these directories are by design during a package upgrade, maybe put the sysmon configuration file in a different path and automatically run sysmon -i pointing to that configuration file