Difference between revisions of "Logging"
| Line 6: | Line 6: | ||
=The Installer= | =The Installer= | ||
| − | The installer is made of two pieces, <code>Truxton_Installer.exe</code> and <code>Truxton.msi</code> | + | The installer is made of two pieces, <code>Truxton_Installer.exe</code> and <code>Truxton.msi.</code> |
The executable will gather information about the system and use it to feed parameters to the [https://docs.microsoft.com/en-us/windows/win32/msi/standard-installer-command-line-options Microsoft Installer]. | The executable will gather information about the system and use it to feed parameters to the [https://docs.microsoft.com/en-us/windows/win32/msi/standard-installer-command-line-options Microsoft Installer]. | ||
The program will detail its every thought to the [[Log File Locations#Setup|log file]]. | The program will detail its every thought to the [[Log File Locations#Setup|log file]]. | ||
It will tell Microsoft Installer write to a log in the user's [https://en.wikipedia.org/wiki/Environment_variable#LOCALAPPDATA local app data] <code>Low</code> folder. | It will tell Microsoft Installer write to a log in the user's [https://en.wikipedia.org/wiki/Environment_variable#LOCALAPPDATA local app data] <code>Low</code> folder. | ||
This folder is writable from the Microsoft Installer as it switches between user and Administrator mode. | This folder is writable from the Microsoft Installer as it switches between user and Administrator mode. | ||
| − | Once the Microsoft Installer is finished, control is passed back to <code>Truxton_Installer.exe</code> which will complete the installation | + | Once the Microsoft Installer is finished, control is passed back to <code>Truxton_Installer.exe</code> which will complete the installation steps. |
=The Desktop= | =The Desktop= | ||
| Line 18: | Line 18: | ||
=The Truxton Service= | =The Truxton Service= | ||
| − | Logs to the [https://docs.microsoft.com/en-us/windows/win32/wes/windows-event-log Application Log] | + | Logs to the [https://docs.microsoft.com/en-us/windows/win32/wes/windows-event-log Application Log]. |
| + | This allows Windows monitoring and control processes keep track of what the service is doing. | ||
| + | It is Microsoft's best practice for services to log to the event log. | ||
| + | When in a cloud environment, these log messages are forwarded to a central monitoring service to detect any problems. | ||
| + | |||
| + | =Off-Machine Logging= | ||
| + | Truxton also uses [https://en.wikipedia.org/wiki/Syslog syslog] for high-volume situations. | ||
| + | Typically, the more log messages you have, the less value they are. | ||
| + | They produce a large amount of noise with just a few nuggets of information. | ||
| + | If you [[Turn on Syslogging|turn this log on]], you will see a steady stream of messages from every part of Truxton. | ||
| + | This will allow you to follow each file created during exploitation as it flows through every [[ETL Stages|ETL]]. | ||
| + | You can use commercial syslog servers, Truxton's [[Turn on Syslogging#Syslog.Server|server]] or syslog running on a separate machine. | ||
Revision as of 09:57, 25 July 2022
This article discusses the many different logs in Truxton and why.
Logging Design
Truxton is designed to have a front-end GUI for humans to interact with as well as back-end systems that humans are not meant to see. This leads to different logging systems being employed.
The Installer
The installer is made of two pieces, Truxton_Installer.exe and Truxton.msi.
The executable will gather information about the system and use it to feed parameters to the Microsoft Installer.
The program will detail its every thought to the log file.
It will tell Microsoft Installer write to a log in the user's local app data Low folder.
This folder is writable from the Microsoft Installer as it switches between user and Administrator mode.
Once the Microsoft Installer is finished, control is passed back to Truxton_Installer.exe which will complete the installation steps.
The Desktop
The Analyst Desktop is a Windows application. It writes
The Truxton Service
Logs to the Application Log. This allows Windows monitoring and control processes keep track of what the service is doing. It is Microsoft's best practice for services to log to the event log. When in a cloud environment, these log messages are forwarded to a central monitoring service to detect any problems.
Off-Machine Logging
Truxton also uses syslog for high-volume situations. Typically, the more log messages you have, the less value they are. They produce a large amount of noise with just a few nuggets of information. If you turn this log on, you will see a steady stream of messages from every part of Truxton. This will allow you to follow each file created during exploitation as it flows through every ETL. You can use commercial syslog servers, Truxton's server or syslog running on a separate machine.
