Logging

Logging

Where the agent writes, what it writes, and how long it keeps it. Everything below lives under C:\ProgramData\ManagedReports\.

Locations

Path	Contents
logs\reportmate-<yyyyMMdd>.log	The rolling Serilog file. One file per day
logs\<yyyy-MM-dd-HHmmss>\unified_payload_<serial>_attempt<n>.json	A copy of each payload as it was sent
logs\<yyyy-MM-dd-HHmmss>\transmission_<serial>_attempt<n>.json	A copy of the legacy device-data request body
cache\<yyyy-MM-dd-HHmmss>\<module>.json	Per-module output from one collection
cache\<yyyy-MM-dd-HHmmss>\event.json	The merged payload for that collection
cache\storage_analysis.json	Cached deep storage walk, reused for 24 hours
usagetracker\<username>.json	Per-user foreground and active time counters
Windows Event Log, Application, source ReportMate	The same entries as the file log, at the same minimum level, unless development mode is on
%LOCALAPPDATA%\ReportMate\startup-crash.log	Unhandled exceptions from the Managed Reports Runner App, per user

The installer sets C:\ProgramData\ManagedReports to SYSTEM and Administrators full control and Users read, so any user can read the logs and cached payloads but only an administrator or the agent can change them.

The rolling file is configured in ConfigureServices(): daily rollover, 10 MB per file, 30 files retained, shared write handle. Change its location with ReportMate:LogDirectory.

Levels

The Serilog minimum level follows the --verbose level of the run:

Run	Minimum level in the file
no flag	Warning
-v	Information
-vv / --verbose	Information
-vvv	Debug
any, with ReportMate:DebugLogging true	Debug

So an unattended scheduled run logs warnings and errors only. That is deliberate — a full collection at Debug is large.

The console sink is added only when a verbose flag is present or Development:Enabled is true. The Windows Event Log sink is added unless Development:Enabled is true.

If the dependency-injection container itself fails to build, the agent falls back to writing a single FATAL ERROR entry to the Application event log under the source ReportMate, and exits 1.

Settings notes

Each run logs one Settings: warning per notable settings event: a YAML file that was ignored and why, a credential moved into the protected store, a readable copy blanked or deleted, or a deprecated registry key still supplying a value. They name the setting and the key, never a credential value. See Configuration.

Reading a run

The Logs tab of the Managed Reports Runner App lists and filters the log files, and its Run tab streams a run's log as it is written. From a shell:

Tail the current day's log:

Get-Content 'C:\ProgramData\ManagedReports\logs\reportmate-*.log' -Tail 100 -Wait

Look at what was actually sent on the last attempt:

Get-ChildItem 'C:\ProgramData\ManagedReports\logs' -Directory |
  Sort-Object Name -Descending |
  Select-Object -First 1 |
  Get-ChildItem -Filter 'unified_payload_*.json'

Look at what a module produced, without any transmission:

Get-ChildItem 'C:\ProgramData\ManagedReports\cache' -Directory |
  Sort-Object Name -Descending |
  Select-Object -First 1

Retention

What	Rule
Rolling log files	30 files, one per day
Transmission log directories	The 10 newest are kept. At most 2000 older directories are deleted per run so a large backlog cannot stall a check-in
Cache directories	Directories older than 24 hours are removed, but the 5 newest are always kept
Storage analysis cache	Overwritten; treated as stale after 24 hours
Usage tracker state	Per-user file, pruned by date inside the tracker

Every cache and log directory name is yyyy-MM-dd-HHmmss — exactly 17 characters. The cache sweep matches on that length and the transmission-log sweep parses the name as that format, so a directory with any other name under those roots is left alone forever. Cache directory names use local time; transmission-log directory names use UTC.

Event log entries in the payload

Distinct from the agent's own logging: several modules read Windows event logs as a data source and put summarised results in the payload — sign-in history in the identity module, threat detections in the security module, and so on. Those are described in Modules.