Site Server Log Accessibility

From version 7.6 and above of FTK, Site Server logs can now be configured to automatically be stored in a specific location. The log file itself will only contain information related to a specific job and not all existing jobs. This can be addressed with the addition of configuration keys that can be added in the ADGWeblabSelfHost.exe.config file in addition to the PowerShell script attached to this article.


Configuration Key

  • SiteServerSourceLogFolder– This key allows users to set a specific folder for which the application will copy logs from.
  • SiteServerDestinationLogFolder - This key allows users to set a specific folder for which the application will reference within the Collections page.
  • SiteServerLogSyncIntervalInMinutes - This key allows users to set a specific folder for which the application will sync between the source and destination folders.


How to configure these keys?

The key required for configuration can be added to FTKC 7.6 and above. It should be added to the configuration file located in the ADGWeblabSelfHost.exe.config file located in C:\Program Files\AccessData\Forensic Tools\7.6\bin.


Key

Value

Example

Notes

SiteServerSourceLogFolder

Value should be a path to a folder where site server logs are currently being stored.

<add key="SiteServerSourceLogFolder" value="E:\Exterro\SiteServerLogs\SiteServerSource" />

 


SiteServerDestinationLogFolder
Value should be a path to a folder which must be accessible by the service account.<add key="SiteServerDestinationLogFolder" value="E:\Exterro\SiteServerLogs\SiteServerDestination" />
Path must be accessible by the service account.
SiteServerLogSyncIntervalInMinutes
Value should be a numerical value. <add key="SiteServerLogSyncIntervalInMinutes" value="1" />


How to configure the PowerShell script?

Ensure you have downloaded the PowerShell script attached to the this article. It can be found at the bottom of this page.


Within the provided PowerShell Script, the following variables need to be changed to your personal environment variables.

                        

Value 

Explanation

$folders 

The $folder variable represents the location from where you will be copying the log from (i.e. the Site Server log location)

The Location should only contain the Machine IP and not the hostname.

$DestinationFolder

The $Destination folder variable represents the location where you will be storing the log. 

Note: This location has to be given in the Source Key value in the config file.

Add Days

The $files variable represents from which day the log has to be copied (i.e. the value in AddDays(value) {value - contains value start from -1 }

 

Example: -1 represents present day and -2 represents present day and yesterday.

 

Note:  The Value on the $destination folder of the PowerShell Script will be the same as the path mentioned on the Source path within the config file.

 

Graphical user interface, text, application, email

Description automatically generated

Graphical user interface, application

Description automatically generated

 

 

Create a Windows Task Scheduler

            

  1. Open for Task Scheduler.
  2. Select the Task Scheduler Library.
  3. Right-click on it
  4. Click Create Task.
  5. Enter the Name and Description of the Task.
  6. Enable the Run with Highest Priority.
  7. Click on Triggers.
  8. Click New.
  9. Set the Schedule Time on which the task has to be triggered.
  10. Click on Actions and select New.
  11. In Program/script, enter “PowerShell” and on the Argument enter “-File<space>location of the PowerShell script.
  12. Click OK.
  13. Save the Task Scheduler by clicking OK.
  14. Right-click on the Created Task and Click Run.

 

Please provide the username and Password if asked during the task creation process, ensuring it is a domain-level service account.

 


This configuration doesn’t work?

  • Ensure the Exterro service has been restarted.
  • Ensure the config file has been saved.
  • Ensure the syntax is correct.
  • Ensure the version you are testing this on is 7.6 and above.