Skip to content

fix(local): gate client-log scrape on the same SCCM-client check as WMI - #10

Open
chryzsh wants to merge 1 commit into
SpecterOps:mainfrom
chryzsh:fix-local-log-scrape-gate
Open

fix(local): gate client-log scrape on the same SCCM-client check as WMI#10
chryzsh wants to merge 1 commit into
SpecterOps:mainfrom
chryzsh:fix-local-log-scrape-gate

Conversation

@chryzsh

@chryzsh chryzsh commented Sep 8, 2026

Copy link
Copy Markdown

Description

local_client_logs_targets() in collectors/local.py only checked platform.system() == "Windows" before scraping CCM\Logs/ccmsetup\Logs. The three WMI resources beside it all gate on _wmi_ccm() (root\CCM namespace present, confirming this box is a currently-enrolled SCCM client). The log scrape never got that gate.

CMBP's original Invoke-LocalCollection (PowerShell) returns at its own top when the root\CCM namespace is absent, before ever reaching its log-scrape code later in the same function. Splitting that into separate resource functions during the port dropped the gate for the log scrape specifically. Not a deliberate divergence, a fidelity gap.

Found against a real environment: a box with a large DataTransferService.log (one line per content byte-range chunk) printed thousands of VERBOSE "Found URL" lines per second, and the scrape ran on any Windows box regardless of whether it was actually a current SCCM client.

Fix

local_client_logs_targets() now gates on _wmi_ccm() too. A box with leftover log folders from an uninstalled client, or any non-client box, is skipped before opening a log file. A real, currently-enrolled client scrapes its logs the same as before.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)

Testing

New regression test test_log_scrape_skipped_when_not_an_sccm_client in tests/local_log_scrape_regex_test.py. Existing tests updated to mock _wmi_ccm instead of platform.system. Full suite passes.

local_client_logs_targets() only checked platform.system() == "Windows" before
scraping CCM/ccmsetup logs, unlike the three WMI resources beside it which all
gate on _wmi_ccm() (root\CCM namespace present). CMBP's original
Invoke-LocalCollection returned at its own top when that namespace was absent,
before ever reaching its log-scrape code -- a fidelity gap introduced when the
port split one PS1 function into separate resource functions, not a deliberate
divergence. Now gates on _wmi_ccm() too, so a box with leftover log folders
from an uninstalled client is skipped before opening any log file.

Ticket: con-8bed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant