# Sidecar Collector Binary Whitelist Issue

**URL:** https://community.graylog.org/t/sidecar-collector-binary-whitelist-issue/10164
**Category:** Graylog Central (peer support)
**Tags:** sidecar
**Created:** [April 26, 2019, 10:17pm UTC](https://community.graylog.org/t/sidecar-collector-binary-whitelist-issue/10164 "2019-04-26T22:17:23Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![megan201296](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/megan201296/32/2847_2.png) [@megan201296](https://community.graylog.org/u/megan201296)
#### Post date: [April 26, 2019, 10:17pm UTC](https://community.graylog.org/t/sidecar-collector-binary-whitelist-issue/10164/1 "2019-04-26T22:17:23Z")

</div>

I’m trying to make a collector for Sysmon via the Graylog 3 sidecar functionality. I’ve created the log collection, the configuration, and applied it to a sidecar. Despite the fact I’ve updated the sidercar.yml file on the host to include the path for sysmon in the whitelist, I am still getting `Couldn't execute collector C:\Windows\System32\Sysmon64.exe [C:\Windows\System32\sysmon64.exe], binary path is not included in`collector\_binaries\_whitelist’ config option`. I also tried just disabling the binary whitelist but that did not work either. Below are screenshots of the collector and sidecar configs. Anyone see what I’m doing wrong?

 ![22%20PM](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/230031ed41278b2b5f49089ca9351353641e966c.jpeg)  
 ![13%20PM](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7797f283e3921cef7789c4336ab471b3eb0d0557.png)

---

<div class="post-metadata">

### Author: ![michael.ehrenreich](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/michael.ehrenreich/32/4061_2.png) [@michael.ehrenreich](https://community.graylog.org/u/michael.ehrenreich)
#### Post date: [April 27, 2019, 10:12am UTC](https://community.graylog.org/t/sidecar-collector-binary-whitelist-issue/10164/2 "2019-04-27T10:12:11Z")

</div>

Was the error message the same after you disabled the whitelist? And how did you disable it, just by commenting it out in the config or by passing an empty list?

---

<div class="post-metadata">

### Author: ![megan201296](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/megan201296/32/2847_2.png) [@megan201296](https://community.graylog.org/u/megan201296)
#### Post date: [April 27, 2019, 2:39pm UTC](https://community.graylog.org/t/sidecar-collector-binary-whitelist-issue/10164/3 "2019-04-27T14:39:36Z")

</div>

Yes, same error message. And disabled it by passing an empty list.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [May 11, 2019, 2:39pm UTC](https://community.graylog.org/t/sidecar-collector-binary-whitelist-issue/10164/4 "2019-05-11T14:39:37Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.