# Sysmon/Sysmon64 not visible in metricbeats for sysmon version 15
**URL:** https://discuss.elastic.co/t/sysmon-sysmon64-not-visible-in-metricbeats-for-sysmon-version-15/345308
**Category:** Beats
**Tags:** metricbeat
**Created:** [October 18, 2023, 4:12pm UTC](https://discuss.elastic.co/t/sysmon-sysmon64-not-visible-in-metricbeats-for-sysmon-version-15/345308 "2023-10-18T16:12:42Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)
#### Post date: [October 18, 2023, 4:12pm UTC](https://discuss.elastic.co/t/sysmon-sysmon64-not-visible-in-metricbeats-for-sysmon-version-15/345308/1 "2023-10-18T16:12:42Z")
Hi there,
We are using the system module and metricsets process. I can see all the other CPU/memory metrics except the Sysmon.
Sysmon is completely missing in the output.
Here is my system.yml
```auto
- module: system
period: 10s
metricsets:
- process
processes: ["WmiPrvSE.exe" , "metricbeat.exe", "(i?)sysmon.*", "Sysmon.exe" , "Sysmon64.exe*"]
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [October 19, 2023, 4:53pm UTC](https://discuss.elastic.co/t/sysmon-sysmon64-not-visible-in-metricbeats-for-sysmon-version-15/345308/2 "2023-10-19T16:53:13Z")
@shani_angarkadu
I am seeing the same behavior at the moment, I do not have an answer at this moment...
Of course you can install winlogbbeat to monitor events
> **[Sysmon Module | Winlogbeat Reference \[8.10\] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-module-sysmon.html)**
---
### Author:  [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)
#### Post date: [October 19, 2023, 5:36pm UTC](https://discuss.elastic.co/t/sysmon-sysmon64-not-visible-in-metricbeats-for-sysmon-version-15/345308/3 "2023-10-19T17:36:08Z")
Actually, we deployed agents to monitor system metrics and the winlog beat to get the sysmon events.
We want to know how much CPU is consumed by sysmon CPU process , so we can adjust the sysmon config.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [October 19, 2023, 5:48pm UTC](https://discuss.elastic.co/t/sysmon-sysmon64-not-visible-in-metricbeats-for-sysmon-version-15/345308/4 "2023-10-19T17:48:54Z")
Understood.
I do not have an answer as to why Sysmon does not show up. I do not see it either on my test. I asked internally, we will see if we get an answer.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [October 19, 2023, 5:58pm UTC](https://discuss.elastic.co/t/sysmon-sysmon64-not-visible-in-metricbeats-for-sysmon-version-15/345308/5 "2023-10-19T17:58:36Z")
@shani_angarkadu
Here is you answer ... I was about to guess that
Internal Question:
> Internal : Hi Metrics / Windows peeps what am I missing can metricbeat -\> system \> processes not detect sysmon process. I have metricbeat set to collect all processess ... I see them Alll ... but I don't see Sysmon ... it is running... It is a special processs of something that can not be detected?
Answer
> yes, it's (sysmon) is a protected process now (as of version 15) so it can not be monitored with normal methods. Perhaps osquery might be able to help, using the services table
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [October 19, 2023, 8:29pm UTC](https://discuss.elastic.co/t/sysmon-sysmon64-not-visible-in-metricbeats-for-sysmon-version-15/345308/6 "2023-10-19T20:29:36Z")
Hello,
This is unfortunately a known issue for some time. Please check and +1 [Metricbeat fails to get information for some processes under Windows · Issue #17314 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/17314)
Seems like very basic monitoring feature to be able to get CPU from important processes such as lsass, but also Sysmon, Defender, Elastic Agent etc.....
Best regards,
Willem
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 16, 2023, 10:30pm UTC](https://discuss.elastic.co/t/sysmon-sysmon64-not-visible-in-metricbeats-for-sysmon-version-15/345308/7 "2023-11-16T22:30:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.