worked sysmon_toggle.c