# Sysmon DNS Query missing Status codes **URL:** \ **Category:** Beats\ **Created:** [December 31, 2019, 12:06am UTC](https://discuss.elastic.co/t/sysmon-dns-query-missing-status-codes/213396 "2019-12-31T00:06:24Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Nicholas\_Penning](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicholas_penning/32/55736_2.png) [@Nicholas\_Penning](https://discuss.elastic.co/u/Nicholas_Penning)\ **Post date:** [December 31, 2019, 12:06am UTC](https://discuss.elastic.co/t/sysmon-dns-query-missing-status-codes/213396/1 "2019-12-31T00:06:24Z")
Hello, We are ingesting some SysMon (Version 10.41) DNS logs via WinLogbeat 7.4.0 and have found that some status codes are not either getting translated with the sysmon.js or are not in the list. I will focus on the event log that is in the list. The status is 9560 which should be displaying as DNS\_ERROR\_INVALID\_NAME\_CHAR but instead the logs in Kibana are showing 9560. From Microsoft ([https://docs.microsoft.com/en-us/windows/win32/debug/system-error-codes--9000-11999-](https://docs.microsoft.com/en-us/windows/win32/debug/system-error-codes--9000-11999-)) DNS\_ERROR\_INVALID\_NAME\_CHAR 9560 (0x2558) DNS name contains an invalid character. You can test this by trying to ping www.google,com You see that the status code is in fact 9560 in the Windows event log but for some reason the sysmon.js doesn't clean up like most of the other DNS queries. Any ideas? Thanks! ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [January 20, 2020, 2:49pm UTC](https://discuss.elastic.co/t/sysmon-dns-query-missing-status-codes/213396/2 "2020-01-20T14:49:15Z")
This is a bug. I must have made a mistake in parsing the header file. Can you open a bug on github for this one. ---
**Author:** ![Nicholas\_Penning](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicholas_penning/32/55736_2.png) [@Nicholas\_Penning](https://discuss.elastic.co/u/Nicholas_Penning)\ **Post date:** [January 20, 2020, 6:22pm UTC](https://discuss.elastic.co/t/sysmon-dns-query-missing-status-codes/213396/3 "2020-01-20T18:22:18Z")
Hi Andrew! Yes I can do that. Would you like me to provide all event code's that don't get translated to the names or just this one? Here is the quick list (sysmon.dns.status): 1460 9560 123 1223 4312 10054 ---
**Author:** ![Nicholas\_Penning](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicholas_penning/32/55736_2.png) [@Nicholas\_Penning](https://discuss.elastic.co/u/Nicholas_Penning)\ **Post date:** [January 20, 2020, 6:44pm UTC](https://discuss.elastic.co/t/sysmon-dns-query-missing-status-codes/213396/4 "2020-01-20T18:44:05Z")
I went ahead and created an issue on GitHub, please let me know what other information you may need. > > > For confirmed bugs, please report: > Version: 7.4.0 (WLB) > Operating System: Windows 10 > Discuss Forum URL: https://discuss.elastic.co/t/sysmon-dns-query-missing-status-codes/213396/3 > Steps to Reproduce: With SysMon on a Windows 10... Thanks again for looking into this! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 17, 2020, 8:44pm UTC](https://discuss.elastic.co/t/sysmon-dns-query-missing-status-codes/213396/5 "2020-02-17T20:44:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.