Where Does Sysmon Store Logs and Config?
Sysmon logs to a dedicated Operational event channel, with config supplied at install and a default archive dir.
Last updated
Sysmon installs wherever you put the binary and points at a config file you hand it during install. There is no fixed home directory to memorize, which trips up everyone hunting for one.
What is fixed is where the data goes. Every event lands in the Sysmon Operational channel in Event Viewer, with an evtx file behind it for collectors. Deleted-file copies collect in a Sysmon directory at the volume root by default, which grows quietly until someone notices the disk.
Where Sysmon stores this, by platform
Event Viewer > Applications and Services Logs > Microsoft > Windows > Sysmon > Operational
All Sysmon events land here (Event IDs 1 through 29 plus service events). The backing evtx sits in the winevt Logs folder for SIEM collectors. Config lives wherever your install command pointed with -i or -c.
Frequently asked questions
Where do I read Sysmon events?
The Operational channel under Microsoft Windows Sysmon, not the System log. Filter there first; forwarding rules pointing at System collect nothing from Sysmon.
Notice an outdated path? Let us know.