change directory for Identity Collector logs

[Vincent_Bacher]

Hi mates,

i want to change logdir in ServiceDebugPath.cfg but when shutting down the collector process, modifying the path and starting again the collector process the path is reset to c:\windows\temp.
Any idea?
Thanks in advance
Vince

[G_W_Albrecht]

You could try to make ServiceDebugPath.cfg immutable:

As IC is Windows:

Raymond Chen from Microsoft just recently wrote an article that's closely related: The way to stop people from copying files to a folder is to use NTFS security, not to block drag/dro.... While this one mentions trying to stop someone from copying a file to a specific folder you can use the same solution presented to fix your problem here.

To properly secure the file and prevent tampering you can set the ACLs on the file to have Read permissions but deny Write, Delete and Change permissions. You can set that for a specific user, group, or even everyone! The owner of the file will always have permission to change the permissions, so you can't permenantly lock yourself out (even if you try to deny the CREATOR OWNER special object). Keep in mind that to manually set these from the security dialog box, you'll have to enter the advanced permissions area, they aren't available from the standard page. You may also want to break inheritance so that the file has only the permissions you set and none from its parent.

In this case it would be best to leverage options that are already there and so you won't have to try and hack the system to make work. NTFS has robust security and can accomplish what you want without you writing code. You can also work with the security directly through the WINAPI using methods related to File Security and Access Rights (MSDN). You can provide the permissions when you call the first CreateFile or change permissions after the fact by using SetNamedSecurityInfo or SetSecurityInfo.

EDIT: To address the concerns of malware, you can even deny SYSTEM access so even services running under the system account cannot delete it or write to it. I've actually taken care of one pesky virus in that method. it would keep creating a directory, so I booted PE, emptied out the directory, then denied everyone access to it including the SYSTEM account. The virus was unable to propagate while I worked on removing it.

(https://stackoverflow.com/questions/1333807/how-can-i-make-a-file-trully-immutable-non-deletable-and...)

If you need to make a file immutable under Linux:

[Expert@HostName]# lsattr /.../<filename>
[Expert@HostName]# chattr +i /.../<filename>
[Expert@HostName]# lsattr /.../<filename>

[Vincent_Bacher]

Does lsattr exist on Windows? Not on my server 🙂

[Vincent_Bacher]

OK i set permissions to DENY on this file for the file. Now my setting seems to persist.
Will now have to check if logs are written where i defined......

[Vincent_Bacher]

Interesting. I managed to keep the file unchanged but the process ignores the directory definition and still logs to \windows\temp 😄

[G_W_Albrecht]

Looked into the Registry at HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\CheckPoint\IdentityCollector\

The debug log level and others are set (sk122686 & sk119692) but no path available...

[G_W_Albrecht]

It should be possible to change \windows\temp to a hard link but i am no specialist there...

[Vincent_Bacher]

Thanks for your contribution. I think at this point it's not worth researching more. Maybe later in case we set collector into production.