From e6390db5be6fea3518cd6e1d0f516a044049edc4 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Sun, 5 Apr 2026 17:19:22 +0200 Subject: [PATCH] better diagnosics package collection --- rules/guardrails.json | 3 ++- .../Collectors/DiagnosticsPathGuards.cs | 3 +++ .../Core/DiagnosticsPackageService.cs | 19 +++++++++++++++---- .../AutopilotMonitor.Agent/buildcounter.txt | 2 +- 4 files changed, 21 insertions(+), 6 deletions(-) diff --git a/rules/guardrails.json b/rules/guardrails.json index 7ace609c..d8b01db6 100644 --- a/rules/guardrails.json +++ b/rules/guardrails.json @@ -159,7 +159,8 @@ "C:\\Windows\\CCM\\Logs", "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP", "C:\\ProgramData\\Microsoft\\Windows\\WER", - "C:\\Windows\\Logs\\CBS" + "C:\\Windows\\Logs\\CBS", + "C:\\Install\\Log" ], "blockedFilePrefixes": [ "C:\\Users" diff --git a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Collectors/DiagnosticsPathGuards.cs b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Collectors/DiagnosticsPathGuards.cs index 23388e25..f37e27ca 100644 --- a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Collectors/DiagnosticsPathGuards.cs +++ b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Collectors/DiagnosticsPathGuards.cs @@ -58,6 +58,9 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors // Windows Component-Based Servicing @"C:\Windows\Logs\CBS", + + // Custom install logs (e.g. app installers writing to C:\Install\Log\) + @"C:\Install\Log", }; // Hard blocks: never allowed, even in unrestricted mode diff --git a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Core/DiagnosticsPackageService.cs b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Core/DiagnosticsPackageService.cs index 6c0b128b..0fbd74b0 100644 --- a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Core/DiagnosticsPackageService.cs +++ b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Core/DiagnosticsPackageService.cs @@ -50,6 +50,16 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Core private static readonly string AgentLogFolder = Environment.ExpandEnvironmentVariables(Constants.LogDirectory); + /// + /// File extensions collected from built-in log folders (Agent + IME). + /// Covers standard logs, structured data, traces, event logs, and diagnostics archives. + /// + private static readonly string[] LogFilePatterns = new[] + { + "*.log", "*.txt", "*.json", "*.jsonl", + "*.etl", "*.evtx", "*.xml", "*.csv", "*.cab" + }; + public DiagnosticsPackageService(AgentConfiguration configuration, AgentLogger logger, BackendApiClient apiClient) { _configuration = configuration; @@ -113,11 +123,12 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Core AddSessionInfo(archive, enrollmentSucceeded); // 2. Agent logs - AddLogFiles(archive, AgentLogFolder, "AgentLogs", "*.log"); + foreach (var pattern in LogFilePatterns) + AddLogFiles(archive, AgentLogFolder, "AgentLogs", pattern); - // 3. IME logs - AddLogFiles(archive, ImeLogFolder, "ImeLogs", "IntuneManagementExtension*.log"); - AddLogFiles(archive, ImeLogFolder, "ImeLogs", "AppWorkload*.log"); + // 3. IME logs (all relevant files in the IME log folder) + foreach (var pattern in LogFilePatterns) + AddLogFiles(archive, ImeLogFolder, "ImeLogs", pattern); // 4. Configured additional log paths (global + tenant, validated by guards) foreach (var entry in _configuration.DiagnosticsLogPaths ?? new System.Collections.Generic.List()) diff --git a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt index dca34d14..5559899b 100644 --- a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt +++ b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt @@ -1 +1 @@ -842 +846