Working with UNC log sources (Urchin 7.0)
When a UNC log source is created in Urchin, the following parameters are specified: Server Name/IP, Remote Server Login(username/password), Remote Log Source File.
The flow Urchin uses to get the log from a UNC source is as follows: - Urchin tries to create a connection to the UNC share, specified in the "Server Name/IP" field; If remote username empty - for UNC connection used credentials from account which uses to run Urchin. - If connection established Urchin tries to browse for file(s) specified in the "Remote Log Source File"; - Found files uses as log source. - When Urchin is finished with the log source, it closes the UNC connection.
Note: All UNC log sources created in Urchin 6 will be converted into the new format automatically during the upgrade process.
Urchin 6.602 UNC connection process has some problems:
- When urchin tries to browse without creating connection - Windows creates connection which can't be closed. Therefore UNC log sources which uses different logins to access one server can't be used in one profile. Some systems has restriction for simultaneously UNC connection count - this restriction can be reached because of connections can't be closed.
- If the connection failed, Urchin assumes that it is running under user account that does not have network access. More probably cases like wrong username/password not handled correctly.
- When Urchin process load balanced logs impersonate can block some logs - if that logs not accessible from the user Urchin impersonate to. If used several UNC logs with different local logins - Urchin impersonate from one user to other until last log opened. Urchin terminate impersonation when first UNC logs closed. I think it may affect opened files/database.