Working with UNC Log Sources
When a UNC log source is created in Urchin, the following parameters are specified: Server Name/IP, Remote Server Login, Local Server Login, Remote Log Source File.
The flow Urchin uses to get the log from a UNC source is as follows:
- Urchin tries to browse for the file(s) specified in the "Remote Log Source File";
- If browsing fails, Urchin tries to create a connection to the UNC share, specified in the "Server Name/IP" field;
- If the connection failed, Urchin assumes that it is running under a user account that does not have network access, like Local System account. In this case, it creates a logon session for user account, specified in "Local Server Login" and impersonates itself as this account, i.e. Urchin process starts running under this account. If the "Same Local and Remote Login" option is set to "Yes", the impersonation credentials are taken from "Remote Server Login";
- When the impersonation is successful, Urchin tries again to create a UNC connection to the network share and retries the browsing attempt.
- When Urchin is finished with the log source, it closes the UNC connection and terminates the impersonation, i.e. Urchin process starts running under the account it was running before the impersonation.
Impersonation has the following drawbacks:
- While it is on, the Urchin process is running under different account, which might not have access to the Urchin data directory, thus failing to create any reporting databases.
- The reporting databases, created while the impersonation was on, might not be accessible to the Urchin process when the impersonation is terminated.
- It slows the performance, especially when multiple UNC log files are attached to the profile, since Urchin needs to start/terminate the impersonation for each file.
Therefore, the best practices to using the UNC shares in Urchin are:
- Run Urchin under the account that has access to network. In this case the impersonation does not occur
- Grant read access to the UNC log shares to the user account Urchin is running on. In this case, creating the UNC connection and impersonating might not be necessary.