Syntax pattern from Microsoft Learn; replace placeholders and choose only one documented alternative before use.
sysmon [-i [<configfile>]] [-c [<configfile>]] [-m] [-s] [-u [force]] [-accepteula]sysmon command
System Monitor (Sysmon) is a Windows system service and device driver that you install on a system. This guide lists the documented syntax and parameters for sysmon; check Microsoft Learn for version, role and execution-context requirements.
Documented syntax
sysmon [-i [<configfile>]] [-c [<configfile>]] [-m] [-s] [-u [force]] [-accepteula]The linked Microsoft Learn article is the upstream authority. Availability may depend on Windows release, role, optional feature or interactive tool context.
Syntax pattern
Parameters, options and clauses
| Option / clause | Description |
|---|---|
-i | Microsoft documents this switch; use the linked reference for accepted values, effects and version limits. |
<configfile> | Microsoft documents this argument or subcommand; check the linked reference for its required format and context. |
-c | Microsoft documents this switch; use the linked reference for accepted values, effects and version limits. |
-m | Microsoft documents this switch; use the linked reference for accepted values, effects and version limits. |
-s | Microsoft documents this switch; use the linked reference for accepted values, effects and version limits. |
-u | Microsoft documents this switch; use the linked reference for accepted values, effects and version limits. |
-accepteula | Microsoft documents this switch; use the linked reference for accepted values, effects and version limits. |
Review a command and its target before running it. Commands that alter files, services, accounts, disks, permissions or databases may be difficult to reverse. Test in a safe environment and keep backups.